Issue Extracting Docker Label Value with Dots (com.test.data.job) in VRL

[sairamktummala]

Hi Team,

I'm trying to extract a Docker label (com.test.data.job) inside a remap transform in Vector and use it as a dynamic value when writing logs to an S3 bucket. However, I keep running into type errors.

What I'm Trying to Do:
I want to extract the value of the com.test.data.job label from docker.container_labels and store it in a new field .job_id. Here’s my current transform:

transforms:
  extract_label:
    type: remap
    inputs:
      - docker_logs
    source: |
      .job_id = get(.docker.container_labels, "com.test.data.job") ?? "unknown"

Errors I’m Encountering:
I’ve tried multiple approaches, but I keep getting errors like:

this expression resolves to the exact type string
but the parameter "path" expects the exact type array

or
required argument missing: "path" (position 1)

I also tried escaping dots ("com.test.data.job") and using an array-style lookup (get(["docker", "container_labels", "com.test.data.job"])), but none worked.

My Questions:

1. How can I correctly extract a Docker label that contains dots (.) in its name?
2. What is the correct way to reference deeply nested string keys in remap?
3. Is there an alternative approach if VRL doesn’t support this directly?

Any guidance would be appreciated! Thanks in advance. 🚀

[pront]

this expression resolves to the exact type string
but the parameter "path" expects the exact type array

Per https://vector.dev/docs/reference/vrl/functions/#get, get expects an array so it should be get(.docker.container_labels, ["com.test.data.job"]). Also, interested to see a .docker.container_labels sample event. Based on that you might need ["com", "test", "data", "job"]

This playground example might help.

[sairamktummala]

Thanks for the reply @pront. It doesn't give me an error now but the value passed to aws s3 is null for job_id.

Here is the sample of the docker label with dynamic UUID Value.
com.test.data.job=dca8f06b-813f-4015-bd93-9120dd5c737f

Below is the full content of my vector.yaml file

sources:
  docker_logs:
    type: docker_logs
    include_labels:
      - "com.test.data.job"

transforms:
  extract_label:
    type: remap
    inputs:
      - docker_logs
    source: |
      .job_id, err = get(.docker.container_labels, ["com", "test", "data", "job"]) # job_id is null


sinks:
  aws_s3:
    type: aws_s3
    inputs:
      - extract_label
    bucket: ${S3_BUCKET}
    region: ${AWS_REGION}
    compression: none
    key_prefix: "jobs/{{ job_id }}"
    batch:
      max_bytes: 10485760
      timeout_secs: 10
    encoding:
      codec: text
    filename_append_uuid: false
    filename_time_format: ""
    filename_extension: ""

[pront]

Check out this example. I think this is what you want.

Note that the "com.test.data.job" is a single path. But ["com", "test", "data", "job"] is walking over inner objects.

[sairamktummala]

The value is still null. Are labels the right ones to pull docker container labels?

Updated vector.yaml file below

sources:
  docker_logs:
    type: docker_logs
    include_labels:
      - "com.test.data.job"

transforms:
  extract_label:
    type: remap
    inputs:
      - docker_logs
    source: |
      .job_id = get(.labels, ["com.test.data.job"]) ?? "unknown"


sinks:
  aws_s3:
    type: aws_s3
    inputs:
      - extract_label
    bucket: ${S3_BUCKET}
    region: ${AWS_REGION}
    compression: none
    key_prefix: "jobs/{{ job_id }}"
    batch:
      max_bytes: 10485760
      timeout_secs: 10
    encoding:
      codec: text
    filename_append_uuid: false
    filename_time_format: ""
    filename_extension: ""

[sairamktummala]

Below example worked for me

.job_id = get(.label, ["com.test.data.job"]) ?? "unknown"