Reduce issue with certain labels

[andrewma2]

Hey!

I've been trying to experiment with getting the reduce transform to work with the kubernetes_logs source since I want to parse multiline logs. I notice that when I run on the latest version v0.43.0, I get errors like

2024-12-10T01:21:04.356278Z ERROR transform{component_kind="transform" component_id=reduce component_type=reduce}: vector::internal_events::reduce: Event field could not be reduced. path=KeyString("kubernetes.pod_labels.kubernetes.io/metadata.name") error=InvalidPathSyntax { path: "kubernetes.pod_labels.kubernetes.io/metadata.name" } error_type="condition_failed" stage="processing" internal_log_rate_limit=true
2024-12-10T01:21:04.356316Z ERROR transform{component_kind="transform" component_id=reduce component_type=reduce}: vector::internal_events::reduce: Internal log [Event field could

I think it's because some of the labels from the kubernetes info aren't readable from the reduce perspective?
I found previous discussions like this one where similar issues are brought up, but it seems like the tracking issues were closed a couple months ago, so the latest version should have the fix?

What's interesting is that when I use v0.41.0, it does work. Did something change between these versions?

Repro

I was using the kubernetes source, but came up with a toy example that simplifies it down a lot and be reproduced even without kubernetes

Config

{
	"sources": {
                "in": {
                        "type": "file",
                        "ignore_checkpoints": true,
			"data_dir": "{DATA_DIR}",
			"include": ["{PATH}/multiline_example.txt"]
                }
        },
	"transforms": {
		"add_labels": {
			"type": "remap",
			"inputs": ["in"],
			"source": ".kubernetes = {\"pod_labels\": {\"kubernetes.io/metadata.name\": \"a\"}}"
		},
		"reduce": {
			"type": "reduce",
			"inputs": ["add_labels"],
			"starts_when": {
				"type": "vrl",
				"source": "match!(.message, r'^[^\\s]')"
			},
			"merge_strategies": {
				"message": "concat_newline"
			}
		}
	},
        "sinks": {
                "out": {
                        "type": "console",
                        "inputs": ["reduce"],
                        "encoding": {
                                "codec": "json"
                        }
                }
        }
}   

File (multiline_example.txt)

This is line one
	This is line two
This is line three

Logs/result on v0.41

...
2024-12-10T01:29:01.285705Z  INFO source{component_kind="source" component_id=in component_type=file}: vector::sources::file: Starting file server. include=["/Users/andrew.ma/vector-conf/multiline_example.txt"] exclude=[]
2024-12-10T01:29:01.286294Z  INFO source{component_kind="source" component_id=in component_type=file}:file_server: file_source::checkpointer: Loaded checkpoint data.
2024-12-10T01:29:01.286796Z  INFO source{component_kind="source" component_id=in component_type=file}:file_server: vector::internal_events::file::source: Found new file to watch. file=/Users/andrew.ma/vector-conf/multiline_example.txt
{"file":"/Users/andrew.ma/vector-conf/multiline_example.txt","host":"YFWLXXW2GN","kubernetes":{"pod_labels":{"kubernetes.io/metadata.name":"a"}},"message":"This is line one\n\tThis is line two","source_type":"file","timestamp":"2024-12-10T01:29:01.287097Z","timestamp_end":"2024-12-10T01:29:01.287124Z"}
...

Logs/result on v0.43

...
2024-12-10T01:29:04.723601Z  INFO source{component_kind="source" component_id=in component_type=file}: vector::sources::file: Starting file server. include=["/Users/andrew.ma/vector-conf/multiline_example.txt"] exclude=[]
2024-12-10T01:29:04.724043Z  INFO source{component_kind="source" component_id=in component_type=file}:file_server: file_source::checkpointer: Loaded checkpoint data.
2024-12-10T01:29:04.724439Z  INFO source{component_kind="source" component_id=in component_type=file}:file_server: vector::internal_events::file::source: Found new file to watch. file=/Users/andrew.ma/vector-conf/multiline_example.txt
2024-12-10T01:29:04.724798Z ERROR transform{component_kind="transform" component_id=reduce component_type=reduce}: vector::internal_events::reduce: Event field could not be reduced. path=KeyString("kubernetes.pod_labels.kubernetes.io/metadata.name") error=InvalidPathSyntax { path: "kubernetes.pod_labels.kubernetes.io/metadata.name" } error_type="condition_failed" stage="processing" internal_log_rate_limit=true
2024-12-10T01:29:04.724836Z ERROR transform{component_kind="transform" component_id=reduce component_type=reduce}: vector::internal_events::reduce: Internal log [Event field could not be reduced.] is being suppressed to avoid flooding.
{"file":"/Users/andrew.ma/vector-conf/multiline_example.txt","host":"YFWLXXW2GN","message":"This is line one\n\tThis is line two","source_type":"file","timestamp":"2024-12-10T01:29:04.724642Z","timestamp_end":"2024-12-10T01:29:04.724662Z"}
...

I also tried switching it from kubernetes.io/metadata.name to kubernetes_io/metadata_name but that also doesn't seem to work (as in it works for v0.41 but not v0.43

[pront]

Hi @andrewma2, there was a regression that was fixed (#21989) and the fix will be included in the next patch release v0.43.1. The latter will go out hopefully tomorrow.

[andrewma2]

Ah got it, thanks for the fast reponse!