A collector is software that gathers telemetry from one or more sources, processes it, and forwards it to storage, dashboards, or analysis tools. In observability systems, collectors sit between hosts, applications, and the systems that consume logs, metrics, and traces.
Collectors matter because they handle data that often includes sensitive operational details, credentials-like material, or internal network information. If a collector is misconfigured, exposed to the network, or vulnerable to a bug, an attacker may read telemetry, tamper with what gets forwarded, or use the service as a pivot into monitoring infrastructure. Defenders treat collectors as part of the security boundary: patch them quickly, restrict access, use strong transport protection, and apply least privilege so compromised telemetry components cannot expose more than necessary.