Default value escaping

Elastic Stack Beats
1

How can I escape default values when doing variable substitution?
for example multiline.pattern: '${kubernetes.annotations.multiline_pattern:^(0[1-9]|[1-2][0-9]|3[0-1])-(0[1-9]|1[0-2])-[0-9]{4}}' I need to change the regex pattern but when I add : or filebeat doesn’t match the event correctly, can I somehow escape chars in the default value?

2

Yay, escaping strings :frowning:

Looking at your regex I think the }} is a problem while parsing the configuration. I think you can escape the first } using $}, like:

multiline.pattern: '${kubernetes.annotations.multiline_pattern:^(0[1-9]|[1-2][0-9]|3[0-1])-(0[1-9]|1[0-2])-[0-9]{4}}'

I think variable expansion was recursive (given there are no loops). This means you should be able to write the sample like this (note: I didn't test this):

multiline.pattern: '${kubernetes.annotations.multiline_pattern:${patterns.default.timestamp}}'

patterns:
  default.timestamp: '^(0[1-9]|[1-2][0-9]|3[0-1])-(0[1-9]|1[0-2])-[0-9]{4}'

What's nice is that this removes the need for escaping.

Being adventures we can try to create 'named' predefined multiline patterns for reuse (Note: I didn't test this):

multiline.pattern: '${kubernetes.annotations.multiline_pattern:${patterns.multiline.${kubernetes.annotations.multiline_type:default}}}'

patterns.multiline:
  default: ${pattern.multiline.date}
  date: '^(0[1-9]|[1-2][0-9]|3[0-1])-(0[1-9]|1[0-2])-[0-9]{4}'
  other: '...'

  ...

Here we are playing with string replacement, but one can actually point to actual objects in the configuration file.

3

Thanks steffens, I haven't tried this configuration on Filebeat yet, but would this work with Curator?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.