Lion Cipher Lab

Build a log pipeline with Vector: parse, filter the noise, and route

• SOC Analyst / Blue Team
• Intermediate
• ~45 min
• Free · no account required

Why it matters

SIEMs bill by the gigabyte ingested, and analysts drown in alerts when 95% of the stream is heartbeats and health checks. The fix is log engineering at the pipeline, before the expensive hot store: parse each line into fields, drop the noise, redact and enrich, and route only what matters. Vector is the free, single-binary tool that does exactly this. Learn to shape a stream and you cut ingestion cost, speed up queries, and hand the analyst signal instead of sludge — the difference between a SIEM that pays for itself and one that gets switched off.

What you'll learn

• log parsing
• Vector (VRL)
• pipeline filtering
• log routing
• SIEM cost control

Steps in this lab

1. The mental model: source -> transform -> sink
2. Install Vector (binary or Docker — pick one)
3. Make a realistic noisy log file and COUNT it
4. Write vector.toml: a file source and a VRL remap transform
5. Add a filter transform to DROP the noise
6. Add a console sink and run it — the measured drop
7. Bonus: route security events one way, everything else another
8. The judgment: what to filter, and the trap that eats your evidence

Open the full interactive lab →