Support for windows_event_log source in latest Vector versions?

[yjagdale]

Hi Vector team 👋,

I'm working on ingesting high-volume Windows Event Logs — specifically the ForwardedEvents channel — and Fluent Bit is hitting performance limits due to its hardcoded 1.8MB read cap per cycle.

Vector seems like a great fit given its performance, but I noticed that recent builds no longer include the windows_event_log source, and it appears to be deprecated or missing from release builds.

Can you help clarify:

1. Is the windows_event_log source still supported in any current/stable build?
2. If not, is there any roadmap for bringing it back or alternatives for handling Windows logs with Vector?
3. If self-compiling is the only option — are there build flags/docs to enable it?

Use case:

• Windows Server with high-throughput ForwardedEvents
• Goal is to stream to OpenSearch/Elasticsearch or Kafka
• Fluent Bit cannot keep up due to plugin-level read limits

Thanks in advance for the clarification and any guidance on recommended alternatives!

—

Best,
Yash

[jszwedko]

Hi @yjagdale !

I don't believe there ever was a windows_event_log source in Vector. Where do you see that?

There is a feature request for it which includes some workarounds people are currently using: #1206