diff --git a/infrastructure/security-audit/base/helmrelease-collector.yaml b/infrastructure/security-audit/base/helmrelease-collector.yaml
index a1ffa7f..9d8d1bc 100644
--- a/infrastructure/security-audit/base/helmrelease-collector.yaml
+++ b/infrastructure/security-audit/base/helmrelease-collector.yaml
@@ -168,11 +168,12 @@ spec:
           log_statements:
             - context: log
               statements:
-                # --- объём и шум (guard'ы на nil: у части событий requestObject есть, а metadata/annotations — nil) ---
-                - delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil
-                - delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil
-                - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil and body["requestObject"]["metadata"]["annotations"] != nil
-                - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil and body["responseObject"]["metadata"]["annotations"] != nil
+                # --- объём и шум (guard'ы IsMap: у части событий requestObject — массив или без metadata/annotations;
+                # and в OTTL short-circuit, поэтому индексация вглубь выполняется только для map) ---
+                - delete_key(body["requestObject"]["metadata"], "managedFields") where IsMap(body["requestObject"]) and IsMap(body["requestObject"]["metadata"])
+                - delete_key(body["responseObject"]["metadata"], "managedFields") where IsMap(body["responseObject"]) and IsMap(body["responseObject"]["metadata"])
+                - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where IsMap(body["requestObject"]) and IsMap(body["requestObject"]["metadata"]) and IsMap(body["requestObject"]["metadata"]["annotations"])
+                - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where IsMap(body["responseObject"]) and IsMap(body["responseObject"]["metadata"]) and IsMap(body["responseObject"]["metadata"]["annotations"])
                 # --- маскирование (п.23): значения, а не сама команда exec ---
                 - replace_pattern(body["requestURI"], "(?i)(password|passwd|pwd|token|secret|api[_-]?key)(=|%3D)[^&]*", "$$1$$2***")
                 # --- обогащение ---