Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to coalesce on del(...) #14582

Open
pikeas opened this issue Oct 22, 2024 · 1 comment
Open

Unable to coalesce on del(...) #14582

pikeas opened this issue Oct 22, 2024 · 1 comment

Comments

@pikeas
Copy link

pikeas commented Oct 22, 2024

.ts = del(.timestamp) ?? .ts ?? %docker_logs.timestamp

This fails with:

│ .ts = del(.timestamp) ?? .ts ?? %journald.timestamp
│       ^^^^^^^^^^^^^^^ -- --- this expression never resolves
│       │               │
│       │               remove this error coalescing operation
│       this expression can't fail

From https://vector.dev/docs/reference/vrl/expressions/:

expression | The expression (operand) can be any expression.

The error indicates that only errors may be coalesced, whereas the docs suggest that coalescing can be used generally, to select the first non-null value.

The intent here is to have a consistent timestamp field name after parse_logfmt is applied to heterogenous apps with different log outputs.

@pikeas
Copy link
Author

pikeas commented Oct 22, 2024

.ts = .timestamp ?? .ts also fails.

If this is WAI, please update the docs to clarify that coalescing can only be used for error handling.

expression | The expression (operand) can be any fallible expression (eg, parse_json() but not parse_json!()) that returns an error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant