Errors when trying to collect data from Cisco IOS-XE switch

[purpose-robot]

Question

Hello there,

I am trying to use Vector to collect telemetry data from a Cisco IOS-XE switch. More information can be found here.

The data is sent from the device using gRPC and is encoded as self-describing GPB (KV-GPB).

I used to following protobuf definition: Link to telemetry.proto and specified the generated file in the configuration.

However, I got the following error message and I am not sure how to solve this issue.

I use the current Docker image of Vector: timberio/vector:0.49.0-alpine and currently I print to stdout for testing.

Telegraf does also support collecting telemetry from Cisco switches but they used a different approch: Link to Github

Vector Config

api:
  enabled: true

sources:
  cisco:
    type: socket
    address: 0.0.0.0:9000
    mode: tcp
    decoding:
      codec: protobuf
      protobuf:
        desc_file: telemetry.proto.pb
        message_type: telemetry.Telemetry
    keepalive:
      time_secs: 30
    receive_buffer_bytes: 4000000

sinks:
  console:
    type: console
    inputs:
      - cisco
    target: stdout
    encoding:
      codec: json
      json:
        pretty: true

Vector Logs

2025-09-10T17:08:16.582497Z ERROR source{component_kind="source" component_id=cisco component_type=socket}:connection{peer_addr=172.42.0.1:58257}: vector::internal_events::codecs: Failed deserializing frame. error=Error parsing protobuf: DecodeError { description: "invalid wire type: SixtyFourBit (expected Varint)", stack: [] } error_code="decoder_deserialize" error_type="parser_failed" stage="processing" internal_log_rate_limit=true

[purpose-robot]

Okay, I wrote a small Golang script with a gRPC server and included the provided Protobuf files. Encoded to JSON, the data sent from the switch looks like this:

{
 "nodeIdStr": "switch",
 "subscriptionIdStr": "100",
 "encodingPath": "Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization",
 "collectionId": "1",
 "collectionStartTime": "1758299805410",
 "msgTimestamp": "1758299805410",
 "dataGpbkv": [
  {
   "timestamp": "1758299805410",
   "fields": [
    {
     "name": "keys"
    },
    {
     "name": "content",
     "fields": [
      {
       "name": "five-seconds",
       "uint32Value": 1
      }
     ]
    }
   ]
  }
 ]
}
{
 "nodeIdStr": "switch",
 "subscriptionIdStr": "100",
 "encodingPath": "Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization",
 "collectionId": "1",
 "msgTimestamp": "1758299805413"
}

I still don't know what causes the error or if it is at all possible to collect such streaming telemetry data using Vector.

[pront]

The missing piece is the gRPC server. The socket source reads TCP data, and its Protobuf decoder decodes messages using your descriptor. It does not implement the Cisco gRPC service or unwrap its HTTP/2 transport.

Your Go server can act as a bridge: have it send each decoded JSON object as one compact, newline-terminated line over TCP to Vector:

sources:
  cisco_json:
    type: socket
    mode: tcp
    address: 0.0.0.0:9000
    framing:
      method: newline_delimited
    decoding:
      codec: json

sinks:
  console:
    type: console
    inputs: [cisco_json]
    encoding:
      codec: json

Telegraf's Cisco MDT input is another receiver that supports this protocol. You're welcome to open a feature request for a native Cisco MDT source in Vector.

Please don't hesitate to followup in this thread if you have further questions.