Update to 2025-07-28 13:00

roles/vault/templates/vector.yml

@@ -0,0 +1,18 @@
+---
+
+sources:
+  in_logs_vault:
+    type: file
+    include:
+      - /opt/vault/log/audit.json
+
+transforms:
+  format_logs_vault:
+    type: remap
+    inputs: ["in_logs_vault"]
+    source: |
+      .message = string!(.message)
+      if (is_json(.message)) {
+        .vault = parse_json!(.message)
+        .timestamp = parse_timestamp(del(.vault.time), format: "%FT%H:%M:%S%.fZ", timezone: "UTC") ?? now()
+      }