vectordotdev/vector · error

key must be a string

Error message

key must be a string

What it means

set_secret(key, secret) stores a secret in the target's secret store; the helper starts with key.as_str().expect("key must be a string") (lib/vector-vrl/functions/src/set_secret.rs). The parameter is declared BYTES and VRL's compiler rejects non-string keys at compile time, so this expect is an internal defensive invariant against the compiled contract being broken.

Source

Thrown at lib/vector-vrl/functions/src/set_secret.rs:9

use vector_vrl_category::Category;
use vrl::prelude::*;

fn set_secret(
    ctx: &mut Context,
    key: Value,
    secret: Value,
) -> std::result::Result<Value, ExpressionError> {
    let key_str = key.as_str().expect("key must be a string");
    let secret_str = secret.as_str().expect("secret must be a string");

    ctx.target_mut()
        .insert_secret(key_str.as_ref(), secret_str.as_ref());
    Ok(Value::Null)
}

#[derive(Clone, Copy, Debug)]
pub struct SetSecret;

impl Function for SetSecret {
    fn identifier(&self) -> &'static str {
        "set_secret"
    }

    fn usage(&self) -> &'static str {
        "Sets the given secret in the event."
    }

View on GitHub (pinned to 3708c39b12)

Solutions

1. Keep vector-vrl crates version-aligned with the VRL compiler in your dependency tree
2. Write set_secret("name", value) with literal or statically-typed bytes keys
3. Run programs via Program/compiled handles so kind checks happen first
4. File an issue with the program text if a released Vector build hits this panic

Example fix

# before (vrl)
set_secret(key, "value")   # key: any

# after (vrl)
set_secret(to_string!(key), "value")

# Statically type the key before the call
set_secret(to_string!(key), secret_value)

fn is_bytes(v: &vrl::value::Value) -> bool {
    matches!(v, vrl::value::Value::Bytes(_))
}

When it happens

Trigger: Executing set_secret with a key Value of a non-bytes kind at runtime — impossible through a normally compiled VRL program (set_secret(1, "x") is a compile error); reachable only via compiler regressions, mismatched vector-vrl versions, or direct helper invocation outside the compile pipeline.

Common situations: Embedding VRL without compilation; mixed crate versions in custom builds; VRL compiler development and fuzzing.

Related errors

• argument must be a string
• argument must be a string
• secret must be a string
• argument must be a string
• argument must be a string

AI-assisted analysis of vectordotdev/vector@3708c39b12 (2026-08-20). Data as JSON: /api/errors/93f15c3c4d1e8fc1. Report an issue: GitHub.