{"record":{"id":"5f4b5c4c945c2a6d","repo":"vectordotdev/vector","slug":"argument-must-be-a-string","errorCode":null,"errorMessage":"argument must be a string","messagePattern":"argument must be a string","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/vector-vrl/functions/src/get_secret.rs","lineNumber":5,"sourceCode":"use vector_vrl_category::Category;\nuse vrl::prelude::*;\n\nfn get_secret(ctx: &mut Context, key: Value) -> std::result::Result<Value, ExpressionError> {\n    let key_str = key.as_str().expect(\"argument must be a string\");\n    let value = match ctx.target().get_secret(key_str.as_ref()) {\n        Some(secret) => secret.into(),\n        None => Value::Null,\n    };\n    Ok(value)\n}\n\n#[derive(Clone, Copy, Debug)]\npub struct GetSecret;\n\nimpl Function for GetSecret {\n    fn identifier(&self) -> &'static str {\n        \"get_secret\"\n    }\n\n    fn usage(&self) -> &'static str {\n        \"Returns the value of the given secret from an event.\"\n    }","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/lib/vector-vrl/functions/src/get_secret.rs#L1-L23","documentation":"The get_secret VRL function's runtime helper calls key.as_str().expect(\"argument must be a string\") (lib/vector-vrl/functions/src/get_secret.rs). get_secret is defined with a required BYTES parameter, so the VRL compiler type-checks the argument to bytes before the program runs; this expect is an internal invariant, and a panic means the compiled program bypassed or broke that type guarantee.","triggerScenarios":"In practice unreachable from a normal VRL program — get_secret(123) or get_secret(null) is a compile-time error, not this panic. It fires only if the function is invoked with a non-bytes Value through an untyped/fallible-compilation path, a VRL compiler bug, or a Vector internal API calling the helper directly.","commonSituations":"Regression testing of VRL compiler changes; custom builds embedding VRL functions without the type-checking pass; mismatched vector-vrl crate versions mixed in one binary where parameter kinds changed between versions.","solutions":["Update Vector / vector-vrl crates so compiler and functions come from the same release","If embedding, always run VRL programs through compile() so parameter kinds are enforced before execution","Ensure the argument expression is statically bytes (string literal or a value coerced with to_string) rather than relying on fallible typing","If it reproduces with a stock vector build, capture the VRL program and open an issue in vectordot/vector — it indicates a compiler invariant break"],"exampleFix":"# before (vrl)\nsecret = get_secret(key)   # key untyped / any\n\n# after (vrl) — statically bytes, checked at compile time\nsecret = get_secret(to_string!(key))","handlingStrategy":"type-guard","validationCode":"# In VRL, make the argument statically bytes before calling\nkey = to_string!(key)","typeGuard":"fn is_bytes(v: &vrl::value::Value) -> bool {\n    matches!(v, vrl::value::Value::Bytes(_))\n}","tryCatchPattern":null,"preventionTips":["Always run VRL programs through compile() so parameter kinds are enforced","Keep vector-vrl crates version-aligned with the compiler","Use string literals or to_string! for key arguments"],"tags":["vector","vrl","type-invariant","secrets","panic","internal"],"backgroundTag":"type-invariant-violation","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}