diff --git a/CHANGELOG.md b/CHANGELOG.md
index 235d2b96..a020747c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,8 @@ All notable changes to this project will be documented in this file.
 - Support floating tags for product images via the new `spec.image.stackableVersionPolicy` field
   ([#994]).
 - Add support for 2.12.0 ([#997]).
+- The logs of the `containerdebug` process are now collected by the Vector agent and forwarded to
+  the Vector aggregator ([#1020]).
 - Add `/ready` endpoint to the operator Deployment, which reports the CRD installation status ([#999]).
 - Nodes now have a default affinity to the OPA Pods when OPA authorization is configured ([#1002]).
 
@@ -56,6 +58,10 @@ All notable changes to this project will be documented in this file.
   See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#975]).
 - The operator now watches all resources that it creates and early-exits the reconcile action when the
   cluster is marked for deletion ([#985]).
+- The `containerdebug` process writes its log file again. The operator set
+  `CONTAINERDEBUG_LOG_DIRECTORY`, which containerdebug stopped reading in its version 0.2.0 when it
+  moved to `stackable-telemetry`; the directory is now set via `FILE_LOG_DIRECTORY`. The file is
+  rotated hourly and at most two files are kept, because rotation is opt-in ([#1020]).
 
 ### Removed
 
@@ -82,6 +88,7 @@ All notable changes to this project will be documented in this file.
 [#1013]: https://github.com/stackabletech/nifi-operator/pull/1013
 [#1015]: https://github.com/stackabletech/nifi-operator/pull/1015
 [#1017]: https://github.com/stackabletech/nifi-operator/pull/1017
+[#1020]: https://github.com/stackabletech/nifi-operator/pull/1020
 
 ## [26.7.0] - 2026-07-21
 
diff --git a/docs/modules/nifi/pages/usage_guide/log-aggregation.adoc b/docs/modules/nifi/pages/usage_guide/log-aggregation.adoc
index bffb7001..a8669a9e 100644
--- a/docs/modules/nifi/pages/usage_guide/log-aggregation.adoc
+++ b/docs/modules/nifi/pages/usage_guide/log-aggregation.adoc
@@ -14,4 +14,12 @@ spec:
         enableVectorAgent: true
 ----
 
+NOTE: The logs of the xref:concepts:observability/containerdebug.adoc[`containerdebug` process] are collected as well.
+They are labelled `container: containerdebug`, although no such Kubernetes container exists.
+The process runs in the background of the `nifi` container.
+The label comes from `/stackable/log/containerdebug`, the directory which the operator sets with the `FILE_LOG_DIRECTORY` environment variable and from which the Vector agent derives the container name.
+Overriding `FILE_LOG_DIRECTORY` with `envOverrides` therefore changes how these logs are aggregated.
+The agent only collects files one level below `/stackable/log`, so a sibling directory such as `/stackable/log/nifi` relabels the events instead of dropping them, while any deeper or shallower path stops the aggregation.
+A path outside `/stackable/log` also leaves the log volume.
+
 Further information on how to configure logging, can be found in xref:concepts:logging.adoc[].
diff --git a/rust/operator-binary/src/controller/build/properties/product_logging/mod.rs b/rust/operator-binary/src/controller/build/properties/product_logging/mod.rs
index 931984cd..e1bb15e8 100644
--- a/rust/operator-binary/src/controller/build/properties/product_logging/mod.rs
+++ b/rust/operator-binary/src/controller/build/properties/product_logging/mod.rs
@@ -79,5 +79,7 @@ mod tests {
         assert!(!content.is_empty());
         // NiFi logs via logback's `XMLLayout` (log4j XML), so the `files_log4j` source
         assert!(content.contains("files_log4j"));
+        assert!(content.contains("files_tracing_rs"));
+        assert!(content.contains("*.tracing-rs.json"));
     }
 }
diff --git a/rust/operator-binary/src/controller/build/properties/product_logging/vector-test.yaml b/rust/operator-binary/src/controller/build/properties/product_logging/vector-test.yaml
index 3ac29fd1..872ccf41 100644
--- a/rust/operator-binary/src/controller/build/properties/product_logging/vector-test.yaml
+++ b/rust/operator-binary/src/controller/build/properties/product_logging/vector-test.yaml
@@ -101,6 +101,285 @@ tests:
                 "timestamp": t'2024-01-01T00:00:00Z'
               }
 
+              assert_eq!(expected_log_event, .)
+  - name: Test tracing-rs log
+    inputs:
+      - type: log
+        insert_at: processed_files_tracing_rs
+        log_fields:
+          file: /stackable/log/containerdebug/containerdebug.2026-11-02-14.tracing-rs.json
+          message: '{"timestamp":"2026-11-02T14:49:28.028922Z","level":"INFO","fields":{"message":"found disk","disk.name":"overlay"},"target":"containerdebug::system_information::disk"}'
+          pod: nifi-node-default-0
+          source_type: file
+          timestamp: 2026-11-02T14:49:29.473487331Z
+    outputs:
+      - extract_from: extended_logs
+        expected_event_count: 1
+        conditions:
+          - type: vrl
+            source: |
+              expected_log_event = {
+                "cluster": "nifi",
+                "container": "containerdebug",
+                "file": "containerdebug.2026-11-02-14.tracing-rs.json",
+                "level": "INFO",
+                "logger": "containerdebug::system_information::disk",
+                "message": "found disk\n\ndisk.name=overlay",
+                "timestamp": t'2026-11-02T14:49:28.028922Z',
+                "namespace": "default",
+                "pod": "nifi-node-default-0",
+                "role": "node",
+                "roleGroup": "default"
+              }
+
+              assert_eq!(expected_log_event, .)
+  - name: Test unparsable tracing-rs log
+    inputs:
+      - type: log
+        insert_at: processed_files_tracing_rs
+        log_fields:
+          file: /stackable/log/containerdebug/containerdebug.2026-11-02-14.tracing-rs.json
+          message: '{ unparsable'
+          pod: nifi-node-default-0
+          source_type: file
+          timestamp: 2026-11-02T14:49:29.473487331Z
+    outputs:
+      - extract_from: extended_logs
+        expected_event_count: 1
+        conditions:
+          - type: vrl
+            source: |
+              expected_log_event = {
+                "cluster": "nifi",
+                "container": "containerdebug",
+                "errors": [
+                  .errors[0]
+                ],
+                "file": "containerdebug.2026-11-02-14.tracing-rs.json",
+                "level": "INFO",
+                "logger": "",
+                "message": "{ unparsable",
+                "timestamp": .timestamp,
+                "namespace": "default",
+                "pod": "nifi-node-default-0",
+                "role": "node",
+                "roleGroup": "default"
+              }
+
+              assert_eq!(expected_log_event, .)
+
+              # The remainder of the message contains character offsets into
+              # the VRL source, so only the stable prefix is asserted.
+              assert!(starts_with!(.errors[0], "JSON not parsable: "))
+  - name: Test tracing-rs log which is not a JSON object
+    inputs:
+      - type: log
+        insert_at: processed_files_tracing_rs
+        log_fields:
+          file: /stackable/log/containerdebug/containerdebug.2026-11-02-14.tracing-rs.json
+          message: 'false'
+          pod: nifi-node-default-0
+          source_type: file
+          timestamp: 2026-11-02T14:49:29.473487331Z
+    outputs:
+      - extract_from: extended_logs
+        expected_event_count: 1
+        conditions:
+          - type: vrl
+            source: |
+              expected_log_event = {
+                "cluster": "nifi",
+                "container": "containerdebug",
+                "errors": [
+                  "Parsed event is not a JSON object."
+                ],
+                "file": "containerdebug.2026-11-02-14.tracing-rs.json",
+                "level": "INFO",
+                "logger": "",
+                "message": "false",
+                "timestamp": .timestamp,
+                "namespace": "default",
+                "pod": "nifi-node-default-0",
+                "role": "node",
+                "roleGroup": "default"
+              }
+
+              assert_eq!(expected_log_event, .)
+  - name: Test tracing-rs log with invalid fields
+    inputs:
+      - type: log
+        insert_at: processed_files_tracing_rs
+        log_fields:
+          file: /stackable/log/containerdebug/containerdebug.2026-11-02-14.tracing-rs.json
+          message: '{"timestamp":"unparsable","level":"INVALID","fields":"none","target":null}'
+          pod: nifi-node-default-0
+          source_type: file
+          timestamp: 2026-11-02T14:49:29.473487331Z
+    outputs:
+      - extract_from: extended_logs
+        expected_event_count: 1
+        conditions:
+          - type: vrl
+            source: |
+              expected_log_event = {
+                "cluster": "nifi",
+                "container": "containerdebug",
+                "errors": [
+                  .errors[0],
+                  "Logger/target not found.",
+                  "Level \"INVALID\" unknown, using \"INFO\" instead.",
+                  "Fields are not an object."
+                ],
+                "file": "containerdebug.2026-11-02-14.tracing-rs.json",
+                "level": "INFO",
+                "logger": "",
+                "message": "{\"timestamp\":\"unparsable\",\"level\":\"INVALID\",\"fields\":\"none\",\"target\":null}",
+                "timestamp": .timestamp,
+                "namespace": "default",
+                "pod": "nifi-node-default-0",
+                "role": "node",
+                "roleGroup": "default"
+              }
+
+              assert_eq!(expected_log_event, .)
+
+              # The remainder of the message contains character offsets into
+              # the VRL source, so only the stable prefix is asserted.
+              assert!(starts_with!(.errors[0], "Timestamp not parsable, using current time instead: "))
+  - name: Test tracing-rs log without a timestamp
+    inputs:
+      - type: log
+        insert_at: processed_files_tracing_rs
+        log_fields:
+          file: /stackable/log/containerdebug/containerdebug.2026-11-02-14.tracing-rs.json
+          message: '{"level":"INFO","fields":{"message":"found disk"},"target":"containerdebug::system_information::disk"}'
+          pod: nifi-node-default-0
+          source_type: file
+          timestamp: 2026-11-02T14:49:29.473487331Z
+    outputs:
+      - extract_from: extended_logs
+        expected_event_count: 1
+        conditions:
+          - type: vrl
+            source: |
+              expected_log_event = {
+                "cluster": "nifi",
+                "container": "containerdebug",
+                "errors": [
+                  "Timestamp not found, using current time instead."
+                ],
+                "file": "containerdebug.2026-11-02-14.tracing-rs.json",
+                "level": "INFO",
+                "logger": "containerdebug::system_information::disk",
+                "message": "found disk",
+                "timestamp": .timestamp,
+                "namespace": "default",
+                "pod": "nifi-node-default-0",
+                "role": "node",
+                "roleGroup": "default"
+              }
+
+              assert_eq!(expected_log_event, .)
+
+              # The current time is used and not the timestamp which the file
+              # source attached to the event. The latter reaches the transform
+              # as a string, whereas now() yields a timestamp.
+              assert!(is_timestamp(.timestamp))
+  - name: Test tracing-rs log without a message but with other fields
+    inputs:
+      - type: log
+        insert_at: processed_files_tracing_rs
+        log_fields:
+          file: /stackable/log/containerdebug/containerdebug.2026-11-02-14.tracing-rs.json
+          message: '{"timestamp":"2026-11-02T14:49:28.028922Z","level":"INFO","fields":{"disk.name":"overlay"},"target":"containerdebug::system_information::disk"}'
+          pod: nifi-node-default-0
+          source_type: file
+          timestamp: 2026-11-02T14:49:29.473487331Z
+    outputs:
+      - extract_from: extended_logs
+        expected_event_count: 1
+        conditions:
+          - type: vrl
+            source: |
+              expected_log_event = {
+                "cluster": "nifi",
+                "container": "containerdebug",
+                "file": "containerdebug.2026-11-02-14.tracing-rs.json",
+                "level": "INFO",
+                "logger": "containerdebug::system_information::disk",
+                "message": "disk.name=overlay",
+                "timestamp": t'2026-11-02T14:49:28.028922Z',
+                "namespace": "default",
+                "pod": "nifi-node-default-0",
+                "role": "node",
+                "roleGroup": "default"
+              }
+
+              assert_eq!(expected_log_event, .)
+  - name: Test tracing-rs log with a message which is not a string
+    inputs:
+      - type: log
+        insert_at: processed_files_tracing_rs
+        log_fields:
+          file: /stackable/log/containerdebug/containerdebug.2026-11-02-14.tracing-rs.json
+          message: '{"timestamp":"2026-11-02T14:49:28.028922Z","level":"INFO","fields":{"message":42,"disk.name":"overlay"},"target":"containerdebug::system_information::disk"}'
+          pod: nifi-node-default-0
+          source_type: file
+          timestamp: 2026-11-02T14:49:29.473487331Z
+    outputs:
+      - extract_from: extended_logs
+        expected_event_count: 1
+        conditions:
+          - type: vrl
+            source: |
+              expected_log_event = {
+                "cluster": "nifi",
+                "container": "containerdebug",
+                "file": "containerdebug.2026-11-02-14.tracing-rs.json",
+                "level": "INFO",
+                "logger": "containerdebug::system_information::disk",
+                "message": "disk.name=overlay\nmessage=42",
+                "timestamp": t'2026-11-02T14:49:28.028922Z',
+                "namespace": "default",
+                "pod": "nifi-node-default-0",
+                "role": "node",
+                "roleGroup": "default"
+              }
+
+              assert_eq!(expected_log_event, .)
+  - name: Test tracing-rs log without any fields
+    inputs:
+      - type: log
+        insert_at: processed_files_tracing_rs
+        log_fields:
+          file: /stackable/log/containerdebug/containerdebug.2026-11-02-14.tracing-rs.json
+          message: '{"timestamp":"2026-11-02T14:49:28.028922Z","level":"INFO","fields":{},"target":"containerdebug::system_information::disk"}'
+          pod: nifi-node-default-0
+          source_type: file
+          timestamp: 2026-11-02T14:49:29.473487331Z
+    outputs:
+      - extract_from: extended_logs
+        expected_event_count: 1
+        conditions:
+          - type: vrl
+            source: |
+              expected_log_event = {
+                "cluster": "nifi",
+                "container": "containerdebug",
+                "errors": [
+                  "Message not found."
+                ],
+                "file": "containerdebug.2026-11-02-14.tracing-rs.json",
+                "level": "INFO",
+                "logger": "containerdebug::system_information::disk",
+                "message": "",
+                "timestamp": t'2026-11-02T14:49:28.028922Z',
+                "namespace": "default",
+                "pod": "nifi-node-default-0",
+                "role": "node",
+                "roleGroup": "default"
+              }
+
               assert_eq!(expected_log_event, .)
   - name: Test Vector internal logs
     inputs:
diff --git a/rust/operator-binary/src/controller/build/properties/product_logging/vector.yaml b/rust/operator-binary/src/controller/build/properties/product_logging/vector.yaml
index d42c109f..3cd35ac8 100644
--- a/rust/operator-binary/src/controller/build/properties/product_logging/vector.yaml
+++ b/rust/operator-binary/src/controller/build/properties/product_logging/vector.yaml
@@ -31,6 +31,12 @@ sources:
       condition_pattern: ^<log4j:event
       timeout_ms: 1000
 
+  # Reads the logs of the containerdebug process
+  files_tracing_rs:
+    type: file
+    include:
+      - ${LOG_DIR}/*/*.tracing-rs.json
+
 transforms:
   processed_files_stdout:
     inputs:
@@ -118,11 +124,92 @@ transforms:
       }
 
   # Extends the processed files with the fields "container" and "file"
+  # Transforms the tracing-rs JSON logs written by the containerdebug process
+  processed_files_tracing_rs:
+    inputs:
+      - files_tracing_rs
+    type: remap
+    source: |
+      raw_message = string!(.message)
+
+      .timestamp = now()
+      .logger = ""
+      .level = "INFO"
+      .message = ""
+      .errors = []
+
+      parsed_event, err = parse_json(raw_message)
+      if err != null {
+        error = "JSON not parsable: " + err
+        .errors = push(.errors, error)
+        log(error, level: "warn")
+        .message = raw_message
+      } else if !is_object(parsed_event) {
+        error = "Parsed event is not a JSON object."
+        .errors = push(.errors, error)
+        log(error, level: "warn")
+        .message = raw_message
+      } else {
+        event = object!(parsed_event)
+
+        timestamp_string, err = string(event.timestamp)
+        if err == null {
+          parsed_timestamp, err = parse_timestamp(timestamp_string, "%+")
+          if err == null {
+            .timestamp = parsed_timestamp
+          } else {
+            .errors = push(.errors, "Timestamp not parsable, using current time instead: " + err)
+          }
+        } else {
+          .errors = push(.errors, "Timestamp not found, using current time instead.")
+        }
+
+        .logger, err = string(event.target)
+        if err != null || is_empty(.logger) {
+          .errors = push(.errors, "Logger/target not found.")
+        }
+
+        level, err = string(event.level)
+        if err != null {
+          .errors = push(.errors, "Level not found, using \"" + .level + "\" instead.")
+        } else if !includes(["TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL"], upcase(level)) {
+          .errors = push(.errors, "Level \"" + level + "\" unknown, using \"" + .level + "\" instead.")
+        } else {
+          .level = upcase(level)
+        }
+
+        fields, err = object(event.fields)
+        if err == null {
+          message, err = string(fields.message)
+          if err == null {
+            # The message is prepended to the other fields, so remove it from
+            # them.
+            del(fields.message)
+          } else {
+            # Keep an unusable message among the other fields instead of
+            # discarding its content.
+            message = ""
+          }
+
+          other_fields = encode_key_value(fields, field_delimiter: "\n")
+          .message = join!(compact([message, other_fields]), "\n\n")
+        } else {
+          .errors = push(.errors, "Fields are not an object.")
+          # Fall back to the raw line, so that its content is not lost.
+          .message = raw_message
+        }
+
+        if is_empty(.message) {
+          .errors = push(.errors, "Message not found.")
+        }
+      }
+
   extended_logs_files:
     inputs:
       - processed_files_stdout
       - processed_files_stderr
       - processed_files_log4j
+      - processed_files_tracing_rs
     type: remap
     source: |
       del(.source_type)
diff --git a/rust/operator-binary/src/controller/build/resource/statefulset.rs b/rust/operator-binary/src/controller/build/resource/statefulset.rs
index 552a377b..cbb0fa6f 100644
--- a/rust/operator-binary/src/controller/build/resource/statefulset.rs
+++ b/rust/operator-binary/src/controller/build/resource/statefulset.rs
@@ -2,6 +2,7 @@
 
 use std::str::FromStr;
 
+use const_format::concatcp;
 use indoc::formatdoc;
 use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::{
@@ -176,8 +177,13 @@ constant!(ZOOKEEPER_CHROOT_CONFIG_MAP_KEY: ConfigMapKey = "ZOOKEEPER_CHROOT");
 
 // The POD_NAME env var is needed to overwrite `nifi.cluster.node.address` later.
 constant!(POD_NAME_ENV: EnvVarName = "POD_NAME");
-// Needed for the `containerdebug` process to log its tracing information to.
-constant!(CONTAINERDEBUG_LOG_DIRECTORY_ENV: EnvVarName = "CONTAINERDEBUG_LOG_DIRECTORY");
+// Let the `containerdebug` process write its tracing information to a file. These are the generic
+// `stackable-telemetry` variables and apply to the whole NiFi container, so any other
+// telemetry-based process in it would log into the same directory and the Vector agent would label
+// its events with `container: containerdebug`.
+constant!(FILE_LOG_DIRECTORY_ENV: EnvVarName = "FILE_LOG_DIRECTORY");
+constant!(FILE_LOG_MAX_FILES_ENV: EnvVarName = "FILE_LOG_MAX_FILES");
+constant!(FILE_LOG_ROTATION_PERIOD_ENV: EnvVarName = "FILE_LOG_ROTATION_PERIOD");
 
 // Names of environment variables exported by shell commands in the containers (never set as
 // Kubernetes `EnvVar`s by the operator) and referenced as `${env:...}` placeholders by the
@@ -216,10 +222,15 @@ pub(crate) fn build_node_rolegroup_statefulset(
     // occurs only once.
     let mut env = EnvVarSet::new()
         .with_field_path(&POD_NAME_ENV, &FieldPathEnvVar::Name)
+        // The directory must be exactly one level below the log directory, because the Vector
+        // agent derives the container name from that path segment.
         .with_value(
-            &CONTAINERDEBUG_LOG_DIRECTORY_ENV,
-            format!("{STACKABLE_LOG_DIR}/containerdebug"),
+            &FILE_LOG_DIRECTORY_ENV,
+            concatcp!(STACKABLE_LOG_DIR, "/containerdebug"),
         )
+        // Rotation is opt-in, so without these the file would grow unbounded.
+        .with_value(&FILE_LOG_ROTATION_PERIOD_ENV, "hourly")
+        .with_value(&FILE_LOG_MAX_FILES_ENV, "2")
         .with_value(&STACKLET_NAME_ENV, cluster.name.to_string());
 
     match &cluster.cluster_config.clustering_backend {
@@ -400,6 +411,7 @@ pub(crate) fn build_node_rolegroup_statefulset(
             {COMMON_BASH_TRAP_FUNCTIONS}
             {remove_vector_shutdown_file_command}
             prepare_signal_handlers
+            mkdir --parents \"$FILE_LOG_DIRECTORY\"
             containerdebug --output={STACKABLE_LOG_DIR}/containerdebug-state.json --loop &
             bin/nifi.sh run &
             wait_for_termination $!
@@ -788,18 +800,20 @@ mod tests {
         let _ = *ZOOKEEPER_HOSTS_CONFIG_MAP_KEY;
         let _ = *ZOOKEEPER_CHROOT_CONFIG_MAP_KEY;
         let _ = *POD_NAME_ENV;
-        let _ = *CONTAINERDEBUG_LOG_DIRECTORY_ENV;
+        let _ = *FILE_LOG_DIRECTORY_ENV;
+        let _ = *FILE_LOG_MAX_FILES_ENV;
+        let _ = *FILE_LOG_ROTATION_PERIOD_ENV;
     }
 
     /// `envOverrides` are applied after every operator-set environment variable, so users can
     /// override any of them (previously the operator-set variables were appended after the
     /// overrides, so the operator's values always took precedence).
-    /// `CONTAINERDEBUG_LOG_DIRECTORY` is used as the example here because it is set
+    /// `FILE_LOG_DIRECTORY` is used as the example here because it is set
     /// unconditionally by the operator.
     #[test]
     fn env_overrides_take_precedence_over_operator_set_env_vars() {
         // The minimal fixture cluster, plus an `envOverrides` entry on the `default` role group
-        // that collides with the operator-set `CONTAINERDEBUG_LOG_DIRECTORY`.
+        // that collides with the operator-set `FILE_LOG_DIRECTORY`.
         let cluster = validated_cluster_from_yaml(
             r#"
             apiVersion: nifi.stackable.tech/v1alpha1
@@ -821,7 +835,7 @@ mod tests {
                   default:
                     replicas: 1
                     envOverrides:
-                      CONTAINERDEBUG_LOG_DIRECTORY: /custom/log/dir
+                      FILE_LOG_DIRECTORY: /custom/log/dir
             "#,
         );
         let role_group_name = RoleGroupName::from_str("default").expect("valid role group name");
@@ -843,7 +857,7 @@ mod tests {
             .env
             .expect("the nifi container has env vars")
             .into_iter()
-            .filter(|env_var| env_var.name == "CONTAINERDEBUG_LOG_DIRECTORY")
+            .filter(|env_var| env_var.name == "FILE_LOG_DIRECTORY")
             .map(|env_var| (env_var.name, env_var.value.unwrap_or_default()))
             .collect();
 
@@ -851,7 +865,7 @@ mod tests {
         assert_eq!(
             containerdebug,
             [(
-                "CONTAINERDEBUG_LOG_DIRECTORY".to_string(),
+                "FILE_LOG_DIRECTORY".to_string(),
                 "/custom/log/dir".to_string()
             )]
         );
diff --git a/tests/templates/kuttl/logging/nifi-vector-aggregator-values.yaml.j2 b/tests/templates/kuttl/logging/nifi-vector-aggregator-values.yaml.j2
index f0c1391c..3886b562 100644
--- a/tests/templates/kuttl/logging/nifi-vector-aggregator-values.yaml.j2
+++ b/tests/templates/kuttl/logging/nifi-vector-aggregator-values.yaml.j2
@@ -22,47 +22,69 @@ customConfig:
   transforms:
     validEvents:
       type: filter
-      inputs: [vector]
+      inputs:
+        - vector
       condition: is_null(.errors)
     filteredAutomaticLogConfigNodeNifi:
       type: filter
-      inputs: [validEvents]
+      inputs:
+        - validEvents
       condition: >-
         .pod == "test-nifi-node-automatic-log-config-0" &&
         .container == "nifi"
     filteredAutomaticLogConfigNodeGitSync:
       type: filter
-      inputs: [validEvents]
+      inputs:
+        - validEvents
       condition: >-
         .pod == "test-nifi-node-automatic-log-config-0" &&
         .container == "git-sync-0"
     filteredAutomaticLogConfigNodeGitSyncInit:
       type: filter
-      inputs: [validEvents]
+      inputs:
+        - validEvents
       condition: >-
         .pod == "test-nifi-node-automatic-log-config-0" &&
         .container == "git-sync-0-init"
+    filteredAutomaticLogConfigNodeContainerdebug:
+      type: filter
+      inputs:
+        - validEvents
+      condition: >-
+        .pod == "test-nifi-node-automatic-log-config-0" &&
+        .container == "containerdebug"
     filteredAutomaticLogConfigNodeVector:
       type: filter
-      inputs: [validEvents]
+      inputs:
+        - validEvents
       condition: >-
         .pod == "test-nifi-node-automatic-log-config-0" &&
         .container == "vector"
     filteredCustomLogConfigNodeNifi:
       type: filter
-      inputs: [validEvents]
+      inputs:
+        - validEvents
       condition: >-
         .pod == "test-nifi-node-custom-log-config-0" &&
         .container == "nifi"
+    filteredCustomLogConfigNodeContainerdebug:
+      type: filter
+      inputs:
+        - validEvents
+      condition: >-
+        .pod == "test-nifi-node-custom-log-config-0" &&
+        .container == "containerdebug"
     filteredCustomLogConfigNodeVector:
       type: filter
-      inputs: [validEvents]
+      inputs:
+        - validEvents
       condition: >-
         .pod == "test-nifi-node-custom-log-config-0" &&
         .container == "vector"
     filteredInvalidEvents:
       type: filter
-      inputs: [vector]
+      inputs:
+        - vector
       condition: |-
         .timestamp == from_unix_timestamp!(0) ||
         is_null(.level) ||
@@ -70,11 +92,29 @@ customConfig:
         is_null(.message)
   sinks:
     test:
-      inputs: [filtered*]
+      inputs:
+        - filtered*
       type: blackhole
+    # Shows all events received from the agents. This sink is intentional and
+    # not a debugging leftover: if a "filtered*" transform gathers no event,
+    # then the assertion only reports a count, whereas this log shows which
+    # pod and container names actually arrived. A failure in CI cannot be
+    # reproduced by enabling this afterwards, so it is kept enabled at the
+    # price of the log volume.
+    stdout:
+      inputs:
+        - vector
+      type: console
+      encoding:
+        codec: json
+      buffer:
+        # Avoid back pressure from a stalling stdout. The test should not
+        # fail because of a sink which only aids debugging.
+        when_full: drop_newest
 {% if lookup('env', 'VECTOR_AGGREGATOR') %}
     aggregator:
-      inputs: [vector]
+      inputs:
+        - vector
       type: vector
       routing:
         endpoints: