{"record":{"id":"f3778455414a841f","repo":"vectordotdev/vector","slug":"all-json-file-keys-should-be-matched","errorCode":null,"errorMessage":"all json-file keys should be matched","messagePattern":"all json-file keys should be matched","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/sources/kubernetes_logs/parser/docker.rs","lineNumber":86,"sourceCode":"        Ok(JsonValue::Object(object)) => {\n            for (key, value) in object {\n                match key.as_str() {\n                    MESSAGE_KEY => drop(log.insert(&target_path, value)),\n                    STREAM_KEY => log_namespace.insert_source_metadata(\n                        Config::NAME,\n                        log,\n                        Some(LegacyKey::Overwrite(path!(STREAM_KEY))),\n                        path!(STREAM_KEY),\n                        value,\n                    ),\n                    TIMESTAMP_KEY => log_namespace.insert_source_metadata(\n                        Config::NAME,\n                        log,\n                        log_schema().timestamp_key().map(LegacyKey::Overwrite),\n                        path!(\"timestamp\"),\n                        value,\n                    ),\n                    _ => unreachable!(\"all json-file keys should be matched\"),\n                };\n            }\n            Ok(())\n        }\n        Ok(_) => Err(ParsingError::NotAnObject { message: bytes }),\n        Err(err) => Err(ParsingError::InvalidJson {\n            source: err,\n            message: bytes,\n        }),\n    }\n}\n\nconst DOCKER_MESSAGE_SPLIT_THRESHOLD: usize = 16 * 1024; // 16 Kib\n\nfn normalize_event(\n    log: &mut LogEvent,\n    log_namespace: LogNamespace,\n) -> Result<(), NormalizationError> {","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/src/sources/kubernetes_logs/parser/docker.rs#L68-L104","documentation":"kubernetes_logs auto-detects the container runtime log format; for Docker json-file lines the parser expects exactly the keys log, stream and time, matching each explicitly. Any other top-level key in the JSON line falls into _ => unreachable!('all json-file keys should be matched'), panicking on the first offending line and killing the log pipeline task.","triggerScenarios":"Docker daemons configured with --log-opt labels=..., env=... or tag=... - these options inject extra top-level keys into every json-file log line; any runtime or sidecar enriching json-file lines with additional fields triggers the same arm.","commonSituations":"Nodes where dockerd has log-opts set globally (/etc/docker/daemon.json); per-container log-opt overrides; Docker versions or logging plugins adding new fields to the standard shape read from /var/log/pods.","solutions":["Remove the log-opts that add keys: drop labels/env/tag from daemon.json or the container's log-opt and restart containers so lines are re-emitted in plain json-file shape","Verify the emitted shape: head a /var/log/pods/<ns>_<pod>_<uid>/<container>/*.log file and confirm only log/stream/time keys","If enrichment keys are required, read those logs with the file source plus a VRL remap instead of kubernetes_logs","Upgrade Vector and check release notes - later versions tolerate unknown json-file keys"],"exampleFix":"# /etc/docker/daemon.json -- before\n{ \"log-driver\": \"json-file\", \"log-opts\": { \"labels\": \"production\" } }\n\n# after\n{ \"log-driver\": \"json-file\" }","handlingStrategy":"validation","validationCode":"# Inspect real log lines before pointing kubernetes_logs at them:\nhead -n 5 /var/log/pods/<ns>_<pod>_<uid>/<container>/*.log\n# json-file lines must contain ONLY log/stream/time keys; then check the daemon:\ndocker info --format '{{.LoggingDriver}}'; cat /etc/docker/daemon.json\n# any log-opts adding keys (labels/env/tag) must be removed","typeGuard":"fn is_plain_docker_json(v: &serde_json::Value) -> bool {\n    v.as_object()\n        .map(|o| o.iter().all(|(k, _)| matches!(k.as_str(), \"log\" | \"stream\" | \"time\")))\n        .unwrap_or(false)\n}","tryCatchPattern":null,"preventionTips":["Keep dockerd log-opts free of labels/env/tag on nodes feeding kubernetes_logs","Gate runtime and Docker upgrades against a canary Vector before fleet rollout","Use file source plus VRL remap for logs carrying extra JSON fields"],"tags":["rust","vector","kubernetes-logs","docker","json-file","parser","panic","log-format"],"backgroundTag":"unexpected-json-log-keys","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}