{"record":{"id":"0b6ea7e020208a3f","repo":"vectordotdev/vector","slug":"stream-must-exist-in-the-event","errorCode":null,"errorMessage":"stream must exist in the event","messagePattern":"stream must exist in the event","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sources/docker_logs/mod.rs","lineNumber":1356,"sourceCode":"        let message_value = match log_namespace {\n            LogNamespace::Vector => log\n                .remove(&vrl::path::OwnedTargetPath::event_root())\n                .expect(\"`.` must exist in the event\"),\n            LogNamespace::Legacy => log\n                .remove(\n                    log_schema()\n                        .message_key_target_path()\n                        .expect(\"global log_schema.message_key to be valid path\"),\n                )\n                .expect(\"`message` must exist in the event\"),\n        };\n        let stream_value = match log_namespace {\n            LogNamespace::Vector => log\n                .get(metadata_path!(DockerLogsConfig::NAME, STREAM))\n                .expect(\"`docker_logs.stream` must exist in the metadata\"),\n            LogNamespace::Legacy => log\n                .get(event_path!(STREAM))\n                .expect(\"stream must exist in the event\"),\n        };\n\n        let stream = stream_value.coerce_to_bytes();\n        let message = message_value.coerce_to_bytes();\n        (stream, message, log)\n    });\n    let line_agg_out = LineAgg::<_, Bytes, LogEvent>::new(line_agg_in, logic);\n    line_agg_out.map(move |(_, message, mut log, _)| {\n        match log_namespace {\n            LogNamespace::Vector => log.insert(&vrl::path::OwnedTargetPath::event_root(), message),\n            LogNamespace::Legacy => log.insert(\n                log_schema()\n                    .message_key_target_path()\n                    .expect(\"global log_schema.message_key to be valid path\"),\n                message,\n            ),\n        };\n        log","sourceCodeStart":1338,"sourceCodeEnd":1374,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/src/sources/docker_logs/mod.rs#L1338-L1374","documentation":"The Legacy branch of line_agg_adapter reads the stdout/stderr tag with log.get(event_path!(STREAM)).expect(\"stream must exist in the event\"). docker_logs inserted the stream field when decoding each line, so this is again an internal invariant; the panic fires when an event reaches multiline aggregation without that field.","triggerScenarios":"An event skipping or losing the stream insertion stage - a regression or custom code path between line decode and line_agg - while multiline is enabled in Legacy namespace.","commonSituations":"Version upgrades touching docker_logs event shaping; forks with extra processing stages before aggregation.","solutions":["Check with a console sink that events still contain the stream field under this config","Remove custom stages between source and aggregator","Patch: default the stream to empty bytes with a warning instead of expecting","Report upstream and upgrade"],"exampleFix":"// before\nLogNamespace::Legacy => log\n    .get(event_path!(STREAM))\n    .expect(\"stream must exist in the event\"),\n\n// after\nLogNamespace::Legacy => log\n    .get(event_path!(STREAM))\n    .unwrap_or_else(|| {\n        warn!(message = \"event missing stream field before line_agg\");\n        Value::Bytes(Bytes::new())\n    }),","handlingStrategy":"validation","validationCode":"let stream_value = log\n    .get(event_path!(STREAM))\n    .cloned()\n    .unwrap_or_else(|| {\n        warn!(message = \"missing stream field\");\n        Value::Bytes(Bytes::new())\n    });","typeGuard":"fn has_stream_field(log: &LogEvent) -> bool {\n    log.get(event_path!(STREAM)).is_some()\n}","tryCatchPattern":"let stream = log\n    .remove(event_path!(STREAM))\n    .map(|v| v.coerce_to_bytes())\n    .unwrap_or_else(|| { warn!(\"missing stream\"); Bytes::new() });","preventionTips":["Keep the field name (STREAM) defined once and used by both insert and read sites","Integration-test Legacy namespace with multiline aggregation","Log-and-default instead of expect for optional grouping fields"],"tags":["rust","panic","invariant","log-event","multiline","docker-logs"],"backgroundTag":"missing-event-field","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}