OpenObserve with Vector on Ubuntu 24.04
by cloudimg
Host logs and metrics flow into OpenObserve from first boot, with authenticated ingest.
An observability stack that is already wired together
Most self-hosted observability starts with an empty database and a blank configuration file. This image does not. Vector is installed and configured as the collection tier for OpenObserve, so by the time you first sign in, this host's own logs and metrics are already flowing into named streams and a dashboard is already charting them.
What is running
- OpenObserve 0.92.2 — the backend for logs, metrics and traces, with a full web interface for search, dashboards and alerting. Bound to loopback and never exposed directly.
- Vector 0.58.0 — the collection and ingest pipeline, reading this host's journald logs and host metrics and forwarding them to OpenObserve.
- nginx — the only network gate, terminating TLS on a certificate generated on your VM.
What is already flowing, with no configuration
- `host_logs` — this VM's systemd journal, collected by Vector
- `host_metrics` — CPU, memory, load, disk, filesystem and network metrics
- A Host Overview (Vector) dashboard, provisioned on first boot, charting log volume, memory, load average and filesystem usage
Bring in the rest of your estate
Two authenticated endpoints are exposed on port 443 for your other machines:
- `/ingest/` — JSON over HTTPS, for any HTTP-capable log shipper
- `/otlp/` — OTLP over HTTP, for any OpenTelemetry SDK or Collector
Both are protected by a credential generated on your VM, and both feed straight into OpenObserve.
Secure by default
Four independent secrets — the OpenObserve login, the remote ingest credential, Vector's own ingest token and the TLS private key — are generated on your VM's first boot. Nothing usable ships inside the image, and no two deployments share a value. Vector authenticates to OpenObserve with a dedicated, revocable ingest-only token, never the administrator account, so a leaked collector credential cannot read your data back.
The only ports reachable from off the box are 22, 80 (which redirects to HTTPS) and 443. OpenObserve, Vector's management API and Vector's ingest listeners are all bound to loopback. No swap ships on the OS disk, and telemetry is stored on a dedicated data disk.
Licensing
OpenObserve is AGPL-3.0 and Vector is MPL-2.0 — both open source, with no per-host, per-user or per-gigabyte licence fee. This image ships the open source build of OpenObserve, not the separately licensed enterprise edition. The cloudimg charge of $0.04 per vCPU/hour covers packaging, security patching, image maintenance and 24/7 support.
"OpenObserve" is a trademark of OpenObserve Inc. and "Vector" is a project of Datadog, Inc. Both names are used here only to identify the software this image contains. cloudimg is not affiliated with, endorsed by or sponsored by OpenObserve Inc. or Datadog, Inc.