vectordotdev / vectordotdev/vector
`abort "msg"` reason only preserved with explicit `reroute_dropped: true`
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 22.6k
- Forks
- 2.3k
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 146
Description
Vector version: 0.58.0
Severity: Major (diagnostic info loss)
Description:
When a VRL program calls abort "diagnostic message", the message text is preserved in metadata.dropped.message only if reroute_dropped: true is set AND a sink subscribes to .dropped.
Source code (confirmed):
src/transforms/remap.rs:395:
if self.reroute_dropped {
vec![
default_output,
TransformOutput::new(...).with_port(DROPPED),
]
} else {
vec![default_output]
}
If reroute_dropped is false, no output port for dropped events is created. The original event is silently discarded. Operators see only "Event mapping aborted." reason in internal logs but lose the abort message text.
Reproduction:
transforms:
parse:
type: remap
inputs: [source]
drop_on_abort: true
# reroute_dropped NOT set
source: |
if !is_ipv4(string!(.col_ip)) {
abort "col_ip invalid: " + string!(.col_ip)
}
sinks:
out:
type: console
inputs: [parse]
When col_ip = "garbage":
- Event is dropped
- Internal logs show only
"Event mapping aborted." - The string
"col_ip invalid: garbage"is lost (not in logs, not in sinks)
Vector runtime tests confirm:
- Sink file: not created (no events reach it)
- Log output:
reason="Event mapping aborted."(no abort text)
Expected:
Abort messages should be preserved somewhere even without reroute_dropped. Options:
- Emit WARN log on abort when
reroute_dropped=false, including the abort message text - Document explicitly: "abort messages are lost without
reroute_dropped: true"
Workaround:
Always set reroute_dropped: true and add a sink subscribed to .dropped:
transforms:
parse:
type: remap
inputs: [source]
drop_on_abort: true
reroute_dropped: true # explicit
source: |
if !is_ipv4(string!(.col_ip)) {
abort "col_ip invalid: " + string!(.col_ip)
}
sinks:
out:
type: console
inputs: [parse]
dl:
type: file
inputs: [parse.dropped]
path: /tmp/dl.jsonl
Impact:
Production operators debugging aborted events have no diagnostic text beyond "abort" reason. Root cause investigation requires adding reroute_dropped: true to every transform in the pipeline, which is not enforced.
Confirmed in source: src/transforms/remap.rs:395 (Vector 0.58.0)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at src/transforms/remap.rs:395 and trace the output handling for aborted events when reroute_dropped is false. Reproduce the behavior with the YAML configuration in the issue and compare the internal log output with the abort message. Review the existing Vector runtime tests mentioned in the report. Done should establish either preserved abort text without rerouting or explicit documentation of its loss.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- observability, stream-processing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100