vectordotdev/vector · error

argument must be a string

Error message

argument must be a string

What it means

The get_secret VRL function's runtime helper calls key.as_str().expect("argument must be a string") (lib/vector-vrl/functions/src/get_secret.rs). get_secret is defined with a required BYTES parameter, so the VRL compiler type-checks the argument to bytes before the program runs; this expect is an internal invariant, and a panic means the compiled program bypassed or broke that type guarantee.

Source

Thrown at lib/vector-vrl/functions/src/get_secret.rs:5

use vector_vrl_category::Category;
use vrl::prelude::*;

fn get_secret(ctx: &mut Context, key: Value) -> std::result::Result<Value, ExpressionError> {
    let key_str = key.as_str().expect("argument must be a string");
    let value = match ctx.target().get_secret(key_str.as_ref()) {
        Some(secret) => secret.into(),
        None => Value::Null,
    };
    Ok(value)
}

#[derive(Clone, Copy, Debug)]
pub struct GetSecret;

impl Function for GetSecret {
    fn identifier(&self) -> &'static str {
        "get_secret"
    }

    fn usage(&self) -> &'static str {
        "Returns the value of the given secret from an event."
    }

View on GitHub (pinned to 3708c39b12)

Solutions

1. Update Vector / vector-vrl crates so compiler and functions come from the same release
2. If embedding, always run VRL programs through compile() so parameter kinds are enforced before execution
3. Ensure the argument expression is statically bytes (string literal or a value coerced with to_string) rather than relying on fallible typing
4. If it reproduces with a stock vector build, capture the VRL program and open an issue in vectordot/vector — it indicates a compiler invariant break

Example fix

# before (vrl)
secret = get_secret(key)   # key untyped / any

# after (vrl) — statically bytes, checked at compile time
secret = get_secret(to_string!(key))

# In VRL, make the argument statically bytes before calling
key = to_string!(key)

fn is_bytes(v: &vrl::value::Value) -> bool {
    matches!(v, vrl::value::Value::Bytes(_))
}

When it happens

Trigger: In practice unreachable from a normal VRL program — get_secret(123) or get_secret(null) is a compile-time error, not this panic. It fires only if the function is invoked with a non-bytes Value through an untyped/fallible-compilation path, a VRL compiler bug, or a Vector internal API calling the helper directly.

Common situations: Regression testing of VRL compiler changes; custom builds embedding VRL functions without the type-checking pass; mismatched vector-vrl crate versions mixed in one binary where parameter kinds changed between versions.

Related errors

• argument must be a string
• key must be a string
• secret must be a string
• argument must be a string
• argument must be a string

AI-assisted analysis of vectordotdev/vector@3708c39b12 (2026-08-20). Data as JSON: /api/errors/5f4b5c4c945c2a6d. Report an issue: GitHub.