vectordotdev/vector · error

secret must be a string

Error message

secret must be a string

What it means

The second guard in set_secret: secret.as_str().expect("secret must be a string") (lib/vector-vrl/functions/src/set_secret.rs). The secret parameter is typed BYTES in the function signature, and the VRL compiler enforces this before execution, so the expect fires only if a non-string secret Value reaches the runtime helper — an internal invariant break rather than a normal user error.

Source

Thrown at lib/vector-vrl/functions/src/set_secret.rs:10

use vector_vrl_category::Category;
use vrl::prelude::*;

fn set_secret(
    ctx: &mut Context,
    key: Value,
    secret: Value,
) -> std::result::Result<Value, ExpressionError> {
    let key_str = key.as_str().expect("key must be a string");
    let secret_str = secret.as_str().expect("secret must be a string");

    ctx.target_mut()
        .insert_secret(key_str.as_ref(), secret_str.as_ref());
    Ok(Value::Null)
}

#[derive(Clone, Copy, Debug)]
pub struct SetSecret;

impl Function for SetSecret {
    fn identifier(&self) -> &'static str {
        "set_secret"
    }

    fn usage(&self) -> &'static str {
        "Sets the given secret in the event."
    }

View on GitHub (pinned to 3708c39b12)

Solutions

1. Upgrade Vector/vector-vrl so compiler and built-ins match
2. Coerce secret values explicitly in VRL: set_secret("key", to_string!(secret_value))
3. Embed via the standard compile-then-execute pipeline only
4. Report reproducible occurrences to vectordot/vector

Example fix

# before (vrl)
set_secret("api_key", secret)   # secret: any

# after (vrl)
set_secret("api_key", to_string!(secret))

# Coerce the secret value to bytes before storing
set_secret("name", to_string!(secret_value))

fn is_bytes(v: &vrl::value::Value) -> bool {
    matches!(v, vrl::value::Value::Bytes(_))
}

When it happens

Trigger: A compiled VRL program invoking set_secret with a secret Value that is not bytes (integer, object, null) at runtime — normally blocked at compile time; occurs with compiler bugs, version-skewed vector-vrl crates, or embeddings that call the helper directly.

Common situations: VRL compiler fuzzing/regressions; custom integrations invoking functions without the type-checking pass; partially upgraded workspaces mixing vector-vrl releases.

Related errors

• argument must be a string
• argument must be a string
• key must be a string
• argument must be a string
• argument must be a string

AI-assisted analysis of vectordotdev/vector@3708c39b12 (2026-08-20). Data as JSON: /api/errors/16b8210e06733475. Report an issue: GitHub.