diff --git a/hopeless-masquerade/main.yml b/hopeless-masquerade/main.yml
index a21db4d..3573cef 100644
--- a/hopeless-masquerade/main.yml
+++ b/hopeless-masquerade/main.yml
@@ -5,7 +5,7 @@
   tasks:
 
     - name: Install basic packages
-      apt:
+      ansible.builtin.apt:
         pkg:
           - git
           - net-tools # ifconfig
@@ -21,7 +21,7 @@
   tasks:
 
     - name: Disable SSH password logins
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^(#\s*)?{{ item }} '
         line: "{{ item }} no"
@@ -32,7 +32,7 @@
       notify: Restart sshd
 
     - name: Allow sudo without password
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/sudoers
         regexp: '^%sudo'
         line: '%sudo ALL=(ALL:ALL) NOPASSWD:ALL'
@@ -40,11 +40,81 @@
 
   handlers:
     - name: Restart sshd
-      systemd:
+      ansible.builtin.systemd:
         name: sshd
         state: restarted
 
 # TODO disallow network access from non-tailscale interfaces
 - import_playbook: ../playbooks/tailscale.yml # noqa: name[play]
 
+- import_playbook: vector.yml # noqa: name[play]
+
+# https://grafana.com/blog/2024/07/12/obirdability-how-to-build-an-observability-system-for-bird-songs/
+- name: Ship birdnet logs
+  tags: birdnet_o11y
+  hosts: hopeless-masquerade
+  become: true
+  tasks:
+
+    - name: Create Vector configuration
+      ansible.builtin.copy:
+        content: |
+          sources:
+            journald:
+              type: journald
+
+          transforms:
+            birdnet:
+              type: remap
+              inputs:
+                - journald
+              source: |
+                if ._SYSTEMD_UNIT != "birdnet_analysis.service" {
+                  abort
+                }
+
+                parsed, err = parse_regex(.message, r'.+\(\'(?P<species_latin>.+?)_(?P<species>.+?)\', (?P<confidence>.+?)\)')
+                if err != null {
+                  abort
+                }
+
+                . |= parsed
+
+                if includes(["Engine", "Human"], .species) {
+                  abort
+                }
+
+                # actually probably unnecessary?
+                .confidence_interval = round(to_float!(.confidence), precision: 1)
+
+          sinks:
+            console:
+              type: console
+              inputs:
+                - birdnet
+              encoding:
+                codec: json
+            vlogs:
+              inputs:
+                - birdnet
+              type: http
+              uri: http://lotus-land-story:9428/insert/jsonline?_stream_fields=host&_msg_field=message&_time_field=timestamp
+              compression: gzip
+              encoding:
+                codec: json
+              framing:
+                method: newline_delimited
+              healthcheck:
+                enabled: false
+        dest: /etc/vector/vector.yaml
+        mode: '0644'
+        backup: true
+      notify: Restart Vector
+
+  handlers:
+    - name: Restart Vector
+      ansible.builtin.systemd:
+        name: vector
+        state: restarted
+
 # vim: ft=yaml.ansible
diff --git a/hopeless-masquerade/vector.yml b/hopeless-masquerade/vector.yml
new file mode 100644
index 0000000..0305637
--- /dev/null
+++ b/hopeless-masquerade/vector.yml
@@ -0,0 +1,59 @@
+# https://setup.vector.dev
+
+- name: Install Vector on Debian
+  tags: vector
+  hosts: hopeless-masquerade
+  become: true
+  tasks:
+
+    - name: Install required dependencies
+      ansible.builtin.apt:
+        pkg:
+          - apt-transport-https
+          - curl
+          - gnupg
+        state: present
+        update_cache: true
+
+    - name: Create keyrings directory
+      ansible.builtin.file:
+        path: /usr/share/keyrings
+        state: directory
+        mode: '0755'
+
+    - name: Download Vector GPG key
+      ansible.builtin.get_url:
+        url: https://keys.datadoghq.com/DATADOG_APT_KEY_CURRENT.public
+        dest: /tmp/vector_key.public
+        mode: '0644'
+
+    - name: Import Vector GPG key
+      ansible.builtin.command: gpg --dearmor --output /usr/share/keyrings/datadog-archive-keyring.gpg /tmp/vector_key.public
+      args:
+        creates: /usr/share/keyrings/datadog-archive-keyring.gpg
+
+    - name: Add Vector repository
+      ansible.builtin.apt_repository:
+        repo: deb [signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg] https://apt.vector.dev/ stable vector-0
+        filename: vector
+        state: present
+        update_cache: true
+
+    - name: Install Vector
+      ansible.builtin.apt:
+        name: vector
+        state: present
+        update_cache: true
+
+    - name: Enable and start Vector service
+      ansible.builtin.systemd:
+        name: vector
+        enabled: true
+        state: started
+        daemon_reload: true
+
+    - name: Clean up temporary key file
+      ansible.builtin.file:
+        path: /tmp/vector_key.public
+        state: absent
+