vectordotdev/vector · error

Key is not found

Error message

Key is not found: {:?}

What it means

This panic comes from the `Index` implementation of `LogEvent`: indexing a log event with `log[key]` guarantees a `&Value` return, so when the path lookup (`parse_path_and_get_value`) yields nothing the implementation panics with the missing key. The library throws it because the indexing operator cannot express a fallible lookup. It means the requested path does not exist in the event (or the path is malformed/points through a non-object value).

Solutions

1. Use the fallible lookup `log.get("key")` (or `parse_path_and_get_value`) and handle the None case instead of indexing
2. Guard with a conditional: only index when the path was confirmed to exist
3. Ensure upstream transforms/sources actually insert the field before it is indexed
4. Verify key spelling and path segment types against the actual event schema

Example fix

// before
let level = log["level"].as_str().unwrap_or("info");
// after
let level = log.get("level").and_then(|v| v.as_str()).unwrap_or("info");

let v = event.get("key"); if v.is_none() { return Err(missing_key_error("key")); }

fn has_key(e: &LogEvent, path: &str) -> bool { e.get(path).is_some() }

When it happens

Trigger: Calling `log["field"]["sub"]` (or `Index::index`) where `field` or `field.sub` is absent, or where an intermediate segment resolves to a non-object/non-array value so the path cannot be traversed; also via VRL/lookup helpers that use the Index impl for guaranteed access.

Common situations: Referencing a field that a source/transform did not always populate (e.g. optional HTTP header), typos or case mismatches in key names, parsing events where nested objects may be missing, and downstream code assuming a field added by an earlier transform is always present.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• `message` must exist in the event
• `.` must exist in the event
• stream must exist in the event
• a record with a next ID must have an event count
• a valid HTTP/1 URI is valid as an HTTP URI

AI-assisted analysis of vectordotdev/vector@bdb87aeaa4 (2026-09-16). Data as JSON: /api/errors/e33ac3b3e11af2a4. Report an issue: GitHub.

Appendix: source

Thrown at lib/vector-core/src/event/log_event.rs:728

    type Error = crate::Error;

    fn try_into(self) -> Result<serde_json::Value, Self::Error> {
        Ok(serde_json::to_value(&self.inner.fields)?)
    }
}

#[cfg(any(test, feature = "test"))]
impl<T> std::ops::Index<T> for LogEvent
where
    T: AsRef<str>,
{
    type Output = Value;

    fn index(&self, key: T) -> &Value {
        self.parse_path_and_get_value(key.as_ref())
            .ok()
            .flatten()
            .unwrap_or_else(|| panic!("Key is not found: {:?}", key.as_ref()))
    }
}

impl<K, V> Extend<(K, V)> for LogEvent
where
    K: AsRef<str>,
    V: Into<Value>,
{
    fn extend<I: IntoIterator<Item = (K, V)>>(&mut self, iter: I) {
        for (k, v) in iter {
            if let Ok(path) = parse_target_path(k.as_ref()) {
                self.insert(&path, v.into());
            }
        }
    }
}

// Allow converting any kind of appropriate key/value iterator directly into a LogEvent.

View on GitHub (pinned to bdb87aeaa4)