Skip to content

abort "msg" reason only preserved with explicit reroute_dropped: true #26391

Description

@28515graj

Vector version: 0.58.0

Severity: Major (diagnostic info loss)

Description:

When a VRL program calls abort "diagnostic message", the message text is preserved in metadata.dropped.message only if reroute_dropped: true is set AND a sink subscribes to .dropped.

Source code (confirmed):
src/transforms/remap.rs:395:

if self.reroute_dropped {
    vec![
        default_output,
        TransformOutput::new(...).with_port(DROPPED),
    ]
} else {
    vec![default_output]
}

If reroute_dropped is false, no output port for dropped events is created. The original event is silently discarded. Operators see only "Event mapping aborted." reason in internal logs but lose the abort message text.

Reproduction:

transforms:
  parse:
    type: remap
    inputs: [source]
    drop_on_abort: true
    # reroute_dropped NOT set
    source: |
      if !is_ipv4(string!(.col_ip)) {
        abort "col_ip invalid: " + string!(.col_ip)
      }

sinks:
  out:
    type: console
    inputs: [parse]

When col_ip = "garbage":

  • Event is dropped
  • Internal logs show only "Event mapping aborted."
  • The string "col_ip invalid: garbage" is lost (not in logs, not in sinks)

Vector runtime tests confirm:

  • Sink file: not created (no events reach it)
  • Log output: reason="Event mapping aborted." (no abort text)

Expected:

Abort messages should be preserved somewhere even without reroute_dropped. Options:

  • Emit WARN log on abort when reroute_dropped=false, including the abort message text
  • Document explicitly: "abort messages are lost without reroute_dropped: true"

Workaround:

Always set reroute_dropped: true and add a sink subscribed to .dropped:

transforms:
  parse:
    type: remap
    inputs: [source]
    drop_on_abort: true
    reroute_dropped: true  # explicit
    source: |
      if !is_ipv4(string!(.col_ip)) {
        abort "col_ip invalid: " + string!(.col_ip)
      }

sinks:
  out:
    type: console
    inputs: [parse]
  dl:
    type: file
    inputs: [parse.dropped]
    path: /tmp/dl.jsonl

Impact:

Production operators debugging aborted events have no diagnostic text beyond "abort" reason. Root cause investigation requires adding reroute_dropped: true to every transform in the pipeline, which is not enforced.

Confirmed in source: src/transforms/remap.rs:395 (Vector 0.58.0)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions