grafana / loki

Like Prometheus, but for logs.
https://grafana.com/loki
GNU Affero General Public License v3.0
23.68k stars 3.42k forks source link

Unable to coalesce on del(...) #14582

Open pikeas opened 3 hours ago

pikeas commented 3 hours ago
.ts = del(.timestamp) ?? .ts ?? %docker_logs.timestamp

This fails with:

│ .ts = del(.timestamp) ?? .ts ?? %journald.timestamp
│       ^^^^^^^^^^^^^^^ -- --- this expression never resolves
│       │               │
│       │               remove this error coalescing operation
│       this expression can't fail

From https://vector.dev/docs/reference/vrl/expressions/:

expression | The expression (operand) can be any expression.

The error indicates that only errors may be coalesced, whereas the docs suggest that coalescing can be used generally, to select the first non-null value.

The intent here is to have a consistent timestamp field name after parse_logfmt is applied to heterogenous apps with different log outputs.

pikeas commented 3 hours ago

.ts = .timestamp ?? .ts also fails.

If this is WAI, please update the docs to clarify that coalescing can only be used for error handling.

expression | The expression (operand) can be any fallible expression (eg, parse_json() but not parse_json!()) that returns an error.