vectordotdev/vector · error

valid message key

Error message

valid message key

What it means

`schema_definition` builds the output schema for the syslog decoder and calls `log_schema().message_key().expect("valid message key")`, asserting that the global log schema always defines a `message` key. In the Legacy log namespace the `message` field is mandatory, so if the schema provider returns None the assumption is broken and the process panics.

Solutions

1. Ensure the global log schema keeps its default `message` key (don't strip required keys from `log_schema()`)
2. If customizing the schema programmatically, always set a message key before building components
3. Refactor the codec to handle an optional message key instead of `expect`

Example fix

// before
log_schema().message_key().expect("valid message key")
// after
let message_key = log_schema().message_key().unwrap_or_else(|| "message".into());

// Rust, before building components with a customized schema
let schema = log_schema();
assert!(schema.message_key().is_some(), "global log schema must define a message key");

fn has_message_key(schema: &LogSchema) -> bool {
    schema.message_key().is_some()
}

let key = log_schema().message_key()
    .unwrap_or_else(|| Bytes::from_static(b"message")); // fallback instead of expect

When it happens

Trigger: Calling `schema_definition` (any use of the syslog decoder's schema, e.g. during topology build or schema validation) while the global `log_schema()` has no `message_key` configured — essentially only under non-standard global schema customization.

Common situations: Tests or embedders that replace/override Vector's default log schema without a `message` key; unusual feature-flag combinations that alter `log_schema()` defaults.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• a record with a next ID must have an event count
• a validated HTTP endpoint is a valid `http 1` URI
• already found inputs
• `Configurable` does not support numbers larger than an…
• Default maximum data file size should never be greater than…

AI-assisted analysis of vectordotdev/vector@bdb87aeaa4 (2026-09-16). Data as JSON: /api/errors/6602d1e2247813d7. Report an issue: GitHub.

Appendix: source

Thrown at lib/codecs/src/decoding/format/syslog.rs:69

            source: self.source,
            lossy: self.syslog.lossy,
        }
    }

    /// Return the type of event build by this deserializer.
    pub fn output_type(&self) -> DataType {
        DataType::Log
    }

    /// The schema produced by the deserializer.
    pub fn schema_definition(&self, log_namespace: LogNamespace) -> schema::Definition {
        match (log_namespace, self.source) {
            (LogNamespace::Legacy, _) => {
                let mut definition = schema::Definition::empty_legacy_namespace()
                    // The `message` field is always defined. If parsing fails, the entire body becomes the
                    // message.
                    .with_event_field(
                        log_schema().message_key().expect("valid message key"),
                        Kind::bytes(),
                        Some("message"),
                    );

                if let Some(timestamp_key) = log_schema().timestamp_key() {
                    // All other fields are optional.
                    definition = definition.optional_field(
                        timestamp_key,
                        Kind::timestamp(),
                        Some("timestamp"),
                    )
                }

                definition = definition
                    .optional_field(&owned_value_path!("hostname"), Kind::bytes(), Some("host"))
                    .optional_field(
                        &owned_value_path!("severity"),
                        Kind::bytes(),

View on GitHub (pinned to bdb87aeaa4)