        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
%{ if jwt_needs_combined ~}
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}

role: Aggregator
replicas: ${replicas}
podAnnotations:
  reloader.stakater.com/auto: "true"
service:
  enabled: true
  type: ClusterIP
  ports:
    - name: otlp-grpc
      port: 4317
      protocol: TCP
    - name: otlp-http
      port: 4318
      protocol: TCP
    - name: dd-agent
      port: 8282
      protocol: TCP
env:
  - name: DATADOG_API_KEY
    valueFrom:
      secretKeyRef:
        name: vector-datadog
        key: api_key
resources:
  requests:
    cpu: ${requests_cpu}
    memory: ${requests_memory}
%{ if limits_cpu != null || limits_memory != null ~}
  limits:
    %{ if limits_cpu != null ~}cpu: "${limits_cpu}"%{ endif ~}
    %{ if limits_memory != null ~}memory: ${limits_memory}%{ endif ~}
%{ endif ~}
podDisruptionBudget:
  enabled: true
  minAvailable: 2

topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: vector

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          topologyKey: kubernetes.io/hostname
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: vector

%{ if service_monitor_enabled ~}
serviceMonitor:
  enabled: true
%{ endif ~}
customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 0.0.0.0:8686
  sources:
    otlp_in:
      type: opentelemetry
      grpc:
        address: 0.0.0.0:4317
      http:
        address: 0.0.0.0:4318
    dd_agent_in:
      type: datadog_agent
      address: 0.0.0.0:8282
      multiple_outputs: true
      disable_metrics: true
      disable_traces: true
      store_api_key: false
      acknowledgements:
        enabled: true
  transforms:
    drop_audit:
      type: filter
      inputs:
        - otlp_in.logs
        - dd_agent_in.logs
      condition: |
        msg = if is_string(.message) { string!(.message) } else { "" }
        ${audit_drop_condition}
    normalize_logs:
      type: remap
      inputs:
        - drop_audit
      source: |
        if exists(.severity) {
          .status = downcase(to_string!(.severity))
          del(.severity)
        }
%{ if email_do_redact ~}
    redact_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        if is_string(.message) {
          .message = replace(string!(.message), email_re, "${email_redaction_replacement}")
        }
        if is_object(.attributes) {
          attrs, _err = object(.attributes)
          if is_object(attrs) {
            .attributes = map_values(attrs) -> |v| {
              if is_string(v) { replace(string!(v), email_re, "${email_redaction_replacement}") } else { v }
            }
          }
        }
%{ endif ~}
%{ if email_do_tag ~}
    tag_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        detected = false
        if is_string(.message) {
          detected = match(string!(.message), email_re)
        }
        if !detected && is_object(.attributes) {
          detected = match(encode_json(.attributes), email_re)
        }
        if detected {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if bearer_do_redact ~}
    redact_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
%{ if bearer_needs_combined ~}
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), bearer_re, "${bearer_token_redaction_replacement}")
        }
%{ endif ~}
%{ if bearer_do_tag ~}
    tag_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
%{ if bearer_needs_combined ~}
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), bearer_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if aws_key_do_redact ~}
    redact_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
%{ if aws_key_needs_combined ~}
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), aws_key_re, "${aws_access_key_redaction_replacement}")
        }
%{ endif ~}
%{ if aws_key_do_tag ~}
    tag_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
%{ if aws_key_needs_combined ~}
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if would_redact && is_string(.message) && match(string!(.message), aws_key_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if jwt_do_redact ~}
    redact_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
%{ if jwt_needs_combined ~}
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), jwt_re, "${jwt_redaction_replacement}")
        }
%{ endif ~}
%{ if jwt_do_tag ~}
    tag_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if jwt_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), jwt_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
  sinks:
    datadog_logs:
      type: datadog_logs
      inputs:
        - ${logs_sink_input}
      default_api_key: $${DATADOG_API_KEY}
      site: ${datadog_site}


All six transforms fixed. `msg` is now defined only inside the `%{ if *_needs_combined ~}` block where it's actually used — so when `combined` isn't needed, VRL never sees the variable at all and the warning disappears.


afplay ~/.claude/sounds/mario/stop/stomp.wav 2>/dev/null || true


I get the following message in the vector pods, 2026-05-12T17:00:03.204723Z  WARN transform{component_kind="transform" component_id=tag_aws_access_keys_logs component_type=remap}: vector::transforms::…


Fix unused variable warning in Vector VRL transform


<local-command-caveat>Caveat: The messages below were generated by the user while running local commands. DO NOT respond to these messages or otherwise consider them in your response unless the user explicitly asks you to.</local-command-caveat>


<command-name>/exit</command-name>
            <command-message>exit</command-message>
            <command-args></command-args>


<local-command-stdout>Bye!</local-command-stdout>