{"record":{"id":"a63f374d282b762e","repo":"vectordotdev/vector","slug":"must-exist-in-the-event","errorCode":null,"errorMessage":"`.` must exist in the event","messagePattern":"`\\.` must exist in the event","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sources/docker_logs/mod.rs","lineNumber":1341,"sourceCode":"            labels,\n            name: name.as_str().trim_start_matches('/').to_owned().into(),\n            name_str: name,\n            image: config.image.unwrap().into(),\n            created_at: created.with_timezone(&Utc),\n        })\n    }\n}\n\nfn line_agg_adapter(\n    inner: impl Stream<Item = LogEvent> + Unpin,\n    logic: line_agg::Logic<Bytes, LogEvent>,\n    log_namespace: LogNamespace,\n) -> impl Stream<Item = LogEvent> {\n    let line_agg_in = inner.map(move |mut log| {\n        let message_value = match log_namespace {\n            LogNamespace::Vector => log\n                .remove(&vrl::path::OwnedTargetPath::event_root())\n                .expect(\"`.` must exist in the event\"),\n            LogNamespace::Legacy => log\n                .remove(\n                    log_schema()\n                        .message_key_target_path()\n                        .expect(\"global log_schema.message_key to be valid path\"),\n                )\n                .expect(\"`message` must exist in the event\"),\n        };\n        let stream_value = match log_namespace {\n            LogNamespace::Vector => log\n                .get(metadata_path!(DockerLogsConfig::NAME, STREAM))\n                .expect(\"`docker_logs.stream` must exist in the metadata\"),\n            LogNamespace::Legacy => log\n                .get(event_path!(STREAM))\n                .expect(\"stream must exist in the event\"),\n        };\n\n        let stream = stream_value.coerce_to_bytes();","sourceCodeStart":1323,"sourceCodeEnd":1359,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/src/sources/docker_logs/mod.rs#L1323-L1359","documentation":"When multiline aggregation is configured, docker_logs pipes events through line_agg_adapter. In the Vector log namespace it extracts the message from the event root with log.remove(&OwnedTargetPath::event_root()).expect(\"`.` must exist in the event\") - the source inserted the message at the root a few stages earlier, so this is a pipeline-internal invariant. It panics when an event reaches the aggregator without a root value because some earlier stage produced or reshaped it differently.","triggerScenarios":"A Vector-internal regression or custom code path that feeds LogEvents into this stream without a root message (e.g. partial-event merge state mishandling), while multiline_config is enabled and log_namespace = true.","commonSituations":"Vector upgrades that changed log-namespace handling; combinations of log_namespace = true with multiline aggregation on docker_logs.","solutions":["Reproduce with multiline disabled to confirm the failing stage","Keep log_namespace explicit and consistent for the source and retest","Patch: replace remove(...).expect(...) with a fallback empty-bytes value and a warning","Report with config + Vector version and upgrade"],"exampleFix":"// before\nlet message_value = log\n    .remove(&vrl::path::OwnedTargetPath::event_root())\n    .expect(\"`.` must exist in the event\");\n\n// after\nlet message_value = log\n    .remove(&vrl::path::OwnedTargetPath::event_root())\n    .unwrap_or_else(|| {\n        warn!(message = \"event missing root message before line_agg\");\n        Value::Bytes(Bytes::new())\n    });","handlingStrategy":"validation","validationCode":"// before the aggregator:\nif log.get(&vrl::path::OwnedTargetPath::event_root()).is_none() {\n    warn!(message = \"event without root message; skipping line_agg\");\n    return log; // bypass aggregation\n}","typeGuard":"fn has_root_message(log: &LogEvent) -> bool {\n    log.get(&vrl::path::OwnedTargetPath::event_root()).is_some()\n}","tryCatchPattern":"let message_value = log\n    .remove(&vrl::path::OwnedTargetPath::event_root())\n    .unwrap_or_else(|| Value::Bytes(Bytes::new())); // or skip the event","preventionTips":["Guard stage-entry invariants at pipeline build time (schema definitions) rather than per event","Integration-test log_namespace = true with multiline enabled on every source that supports both","Replace expects on event shape with schema checks during source construction"],"tags":["rust","panic","invariant","log-event","multiline","docker-logs"],"backgroundTag":"missing-event-field","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}