# Issues with regexes and kubernetes hints based autodiscovery with filebeat 6.4.0

**URL:** <https://discuss.elastic.co/t/issues-with-regexes-and-kubernetes-hints-based-autodiscovery-with-filebeat-6-4-0/148231>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 11, 2018, 10:47pm UTC](https://discuss.elastic.co/t/issues-with-regexes-and-kubernetes-hints-based-autodiscovery-with-filebeat-6-4-0/148231 "2018-09-11T22:47:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Scoble](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_scoble/32/38142_2.png) [@Alex\_Scoble](https://discuss.elastic.co/u/Alex_Scoble)\
**Post date:** [September 11, 2018, 10:47pm UTC](https://discuss.elastic.co/t/issues-with-regexes-and-kubernetes-hints-based-autodiscovery-with-filebeat-6-4-0/148231/1 "2018-09-11T22:47:20Z")

</div>

What I'm about to describe works fine in filebeat 6.3.1. The below only happens when I upgrade the filebeat daemonset for kubernetes to 6.4.0.

We are using hints based autodiscovery in kubernetes. The pod annotations are typically something like

```
  annotations:
    co.elastic.logs/exclude_lines: 'GET\s\"?/status|^\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)[m|K]\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)[m|K]$'
    co.elastic.logs.service-foo/multiline.pattern: '^(\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K](\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K])?)?([0-9]{2}:[0-9]{2}|<[0-9]{2}>[0-9]\s[0-9]{4}-[0-9]{2}-[0-9]{2})'
    co.elastic.logs.service-foo/multiline.negate: 'true'
    co.elastic.logs.service-foo/multiline.match: 'after'
    co.elastic.logs.service-foo-nginx/module: 'nginx'
    co.elastic.logs.service-foo-nginx/fileset.stdout: 'access'
    co.elastic.logs.service-foo-nginx/fileset.stderr: 'error'

```

The errors we are getting in filebeat 6.4.0 are like below:

```
2018-09-11T22:22:00.369Z	ERROR	fileset/factory.go:105	Error creating input: error parsing regexp: missing closing ): `GET\s"?/status|^\x1B\[([0-9]{1` accessing 'exclude_lines.0'
2018-09-11T22:22:00.369Z	ERROR	[autodiscover]	cfgfile/list.go:104	Error creating runner from config: error parsing regexp: missing closing ): `GET\s"?/status|^\x1B\[([0-9]{1` accessing 'exclude_lines.0'

```

You'll notice that the regex for exclude\_lines is getting clipped by filebeat 6.4.0, whereas filebeat 6.3.1 has no such issues.

Not sure why this is working fine in 6.3.1 and not 6.4.0, but something is obviously up.

Thanks,

Alex

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [September 12, 2018, 8:51am UTC](https://discuss.elastic.co/t/issues-with-regexes-and-kubernetes-hints-based-autodiscovery-with-filebeat-6-4-0/148231/2 "2018-09-12T08:51:57Z")

</div>

Hi @Alex_Scoble,

Thank you for your feedback. This looks like a bug to me, as `exclude_lines` is a list, we take `,` as separators for different patterns, but that's wrong in this case, we should come with a way to avoid this issue.

Could you please open a new issue here [https://github.com/elastic/beats/issues](https://github.com/elastic/beats/issues)?

Best regards

---

<div class="post-metadata">

**Author:** ![Alex\_Scoble](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_scoble/32/38142_2.png) [@Alex\_Scoble](https://discuss.elastic.co/u/Alex_Scoble)\
**Post date:** [September 12, 2018, 4:39pm UTC](https://discuss.elastic.co/t/issues-with-regexes-and-kubernetes-hints-based-autodiscovery-with-filebeat-6-4-0/148231/3 "2018-09-12T16:39:26Z")

</div>

Thanks, I just did that.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2018, 4:39pm UTC](https://discuss.elastic.co/t/issues-with-regexes-and-kubernetes-hints-based-autodiscovery-with-filebeat-6-4-0/148231/4 "2018-10-10T16:39:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.