[missedone]

Summary

Adds a victoriametrics sink that sends metrics using the
VictoriaMetrics remote write protocol:
a Prometheus WriteRequest protobuf compressed with zstd, as sent by vmagent. The design is
in the RFC included in this PR (rfcs/2026-09-24-1343-victoriametrics-sink.md).

prometheus_remote_write works with VictoriaMetrics today, but it falls short in several ways:

• tenant_id sets X-Scope-OrgID, which VictoriaMetrics ignores, so cluster tenants need one
  sink per tenant.
• Distributions are bucketed into a fixed buckets list, which is imprecise and doesn't line up
  with the vmrange histograms that VictoriaMetrics client libraries emit.
• Incremental distributions keep every sample in the normalizer (MetricValue::add concatenates
  samples), so memory and CPU grow without bound (likely High CPU usage on prometheus_remote_write sink #19041).
• The default healthcheck fails against VictoriaMetrics (healthcheck.uri option for prometheus_remote_write sink  #13890).

What the sink does:

• Protocol: zstd with X-VictoriaMetrics-Remote-Write-Version: 1. The protobuf is encoded
  directly into a reused buffer, with no intermediate prost structs or grouping map, and each
  request is compressed in a single zstd call, so the frame records its content size, as vmagent
  does.

• Request size: batch.max_bytes limits the estimated encoded size, 8 MiB by default like
  -remoteWrite.maxBlockSize, so distributions that expand into hundreds of series can't push a
  request over -maxInsertRequestSize.

• Distributions: encoded as vmrange histograms (18 log-scale buckets per power of ten), using
  the bucket layout of VictoriaMetrics/metrics. The labels are checked byte for byte against
  golden data generated from the Go implementation. Incremental distributions are accumulated in
  bounded, sink-owned state: at most 488 counters per series, expired by expire_metrics_secs.

• Sketches: sent as summaries with quantiles plus _sum, _count, _min and _max, the way
  VictoriaMetrics stores Datadog sketches.

• Tenancy, set by tenant.mode:

  • none: single-node VictoriaMetrics, or vmauth.
  • path: /insert/<accountID:projectID>/prometheus/api/v1/write, one batch per tenant.
  • labels: vm_account_id/vm_project_id labels, with the tenant also set in the
    MetricMetadata fields vminsert reads.

  tenant.id is subject to template confinement, and the rendered value must be a valid numeric
  tenant, so event data can't change the URL path.

• Per-event credentials for vmauth: an event secret victoriametrics_token is sent as a bearer
  token in place of the configured auth, following the datadog_api_key / splunk_hec_token
  pattern. Batches are split per token.

• Retries match vmagent: requests are dropped only on 400, 409 and 415; every other failure is
  retried, including 401/403 from vmauth while credentials are rotated.

• Healthcheck writes an empty request to the write path, which checks reachability,
  authentication and vmauth routing, not just /health.

• Metadata is sent by default (send_metadata: true), matching -enableMetadata.

The commits are grouped for review: RFC, sink and unit tests, integration test environment and
CI, then docs.

References

Closes: #1343
Related: #13890, #19041, #23990

Vector configuration

    sources:
      statsd:
        type: statsd
        address: 0.0.0.0:8125
        mode: udp

    transforms:
      pick_token:
        type: remap
        inputs: [statsd]
        source: |
          set_secret("victoriametrics_token", get_env_var!("VM_TOKEN_" + upcase!(.tags.team)))

    sinks:
      vm_single:
        type: victoriametrics
        inputs: [statsd]
        endpoint: http://victoriametrics:8428

      vm_cluster:
        type: victoriametrics
        inputs: [statsd]
        endpoint: http://vminsert:8480
        tenant:
          mode: path
          id: "42:{{ tags.project }}"

      vm_vmauth:
        type: victoriametrics
        inputs: [pick_token]
        endpoint: http://vmauth:8427
        auth:
          strategy: bearer
          token: "${VM_TOKEN_DEFAULT}"

How did you test this PR?

• Unit and end-to-end tests (49) in src/sinks/victoriametrics/:

  • the encoder is checked against prost decoding;
  • the vmrange labels and bucket placement against golden data from Go;
  • normalization memory stays bounded;
  • tenant parsing and routing, token override and batch splitting;
  • the size limit;
  • retry classification;
  • the healthcheck.

• Integration tests (cargo vdev int test victoriametrics) cover:

  • single-node VictoriaMetrics;
  • a vmstorage/vminsert/vmselect cluster, with path and label tenants;
  • vmauth routing two tokens to different tenants.

  Data is read back with /api/v1/export.

• Checked against the vmagent remote write client and the vminsert remote write parser in the
  VictoriaMetrics source (headers, block limits, status handling, tenant parsing, metadata tenant
  fields).

• make fmt, clippy, cargo vdev check events, make check-docs, generated docs, changelog
  fragment check, typos, markdownlint.

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[missedone]

I have read the CLA Document and I hereby sign the CLA