Getting an invalid or unsupported using Grok and regexp

Telegraf
1

Hello,
I am facing a strange issue and I am not sure what to do next, long story short, using tail with the next config:

# Offload Job - Task ID and final status per VM
[[inputs.tail]]
  files = ["C:\\ProgramData\\Veeam\\Backup\\SOBR_Offload_*\\*\\Task.*.log"]
  from_beginning = true
  name_override = "veeam_capacitytier_offload_vm"
  watch_method = "poll"
  
  grok_patterns = ['%{CAPACITYTIER_VM_TASKID_LOG}']
  grok_custom_patterns = '''
    DATESTAMP_VEEAM %{MONTHDAY}.%{MONTHNUM}.%{YEAR} %{TIME}
    CAPACITYTIER_VM_TASKID_LOG \[%{DATESTAMP_VEEAM:timestamp:ts-"2.1.2006 15:04:05"}\] \<%{NUMBER:nrtaskid}\> %{WORD}%{SPACE}Set status '%{WORD}' for task session '%{DATA:taskid:tag}', object name '(?<GREEDYDATA:drop>[^{]*) %{DATA:protectedvm:tag}'
    '''
    data_format = "grok"

I am having something like this on my logs:

[29.07.2021 22:23:40] <21> Info         Set status 'InProgress' for task session '421ce82f-1d3f-441c-a392-729c47b4f870', object name 'VMware - Backup Copy to Public Object\VMware - Backup of Linux workloads TIG-MONITOR'

On the usual Grok debugger, it works as expected:

image
image1078×630 7.31 KB

When start telegraf, I get the next error:

error parsing regexp: invalid or unsupported Perl syntax: `(?<`

I have been reading and it should be supported, but maybe something wrong with my regex and go? I am trying to capture the last word really, which is the VM name, so any other Regex or way of doing it will be welcome, the Job name changes all the time so I can not match those, just need last word.

Thank you!

2

Hello @jorgedlcruz,
I’m not sure what’s happening here. But I bet @popey has some answers.