vectordotdev / vectordotdev/vector

`abort "msg"` reason only preserved with explicit `reroute_dropped: true`

Open
#26,391 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
22.6k
Forks
2.3k
Avg merge
1d 7h
Merged PRs (30d)
146

Description

Vector version: 0.58.0

Severity: Major (diagnostic info loss)

Description:

When a VRL program calls abort "diagnostic message", the message text is preserved in metadata.dropped.message only if reroute_dropped: true is set AND a sink subscribes to .dropped.

Source code (confirmed):
src/transforms/remap.rs:395:

if self.reroute_dropped {
    vec![
        default_output,
        TransformOutput::new(...).with_port(DROPPED),
    ]
} else {
    vec![default_output]
}

If reroute_dropped is false, no output port for dropped events is created. The original event is silently discarded. Operators see only "Event mapping aborted." reason in internal logs but lose the abort message text.

Reproduction:

transforms:
  parse:
    type: remap
    inputs: [source]
    drop_on_abort: true
    # reroute_dropped NOT set
    source: |
      if !is_ipv4(string!(.col_ip)) {
        abort "col_ip invalid: " + string!(.col_ip)
      }

sinks:
  out:
    type: console
    inputs: [parse]

When col_ip = "garbage":

  • Event is dropped
  • Internal logs show only "Event mapping aborted."
  • The string "col_ip invalid: garbage" is lost (not in logs, not in sinks)

Vector runtime tests confirm:

  • Sink file: not created (no events reach it)
  • Log output: reason="Event mapping aborted." (no abort text)

Expected:

Abort messages should be preserved somewhere even without reroute_dropped. Options:

  • Emit WARN log on abort when reroute_dropped=false, including the abort message text
  • Document explicitly: "abort messages are lost without reroute_dropped: true"

Workaround:

Always set reroute_dropped: true and add a sink subscribed to .dropped:

transforms:
  parse:
    type: remap
    inputs: [source]
    drop_on_abort: true
    reroute_dropped: true  # explicit
    source: |
      if !is_ipv4(string!(.col_ip)) {
        abort "col_ip invalid: " + string!(.col_ip)
      }

sinks:
  out:
    type: console
    inputs: [parse]
  dl:
    type: file
    inputs: [parse.dropped]
    path: /tmp/dl.jsonl

Impact:

Production operators debugging aborted events have no diagnostic text beyond "abort" reason. Root cause investigation requires adding reroute_dropped: true to every transform in the pipeline, which is not enforced.

Confirmed in source: src/transforms/remap.rs:395 (Vector 0.58.0)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at src/transforms/remap.rs:395 and trace the output handling for aborted events when reroute_dropped is false. Reproduce the behavior with the YAML configuration in the issue and compare the internal log output with the abort message. Review the existing Vector runtime tests mentioned in the report. Done should establish either preserved abort text without rerouting or explicit documentation of its loss.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
observability, stream-processing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.