Processors.regex with pattern generating invalid TOML syntax

Telegraf
1

Hello all

i’m trying to cleanup a tag named instance to remove unnessary infos

from:

user_input_delay_per_process,host=redacted,instance=1:31060\ <conhost.exe>,
user_input_delay_per_process,host=redacted,instance=1:15796\ <explorer.exe>,
user_input_delay_per_process,host=redacted,instance=1:31060\ <conhost.exe>,
user_input_delay_per_process,host=redacted,instance=1:31060\ <conhost.exe>,
user_input_delay_per_process,host=redacted,instance=1:15796\ <explorer.exe>,

to:

user_input_delay_per_process,host=redacted,instance=conhost,
user_input_delay_per_process,host=redacted,instance=explorer.exe,
user_input_delay_per_process,host=redacted,instance=conhost.exe,
user_input_delay_per_process,host=redacted,instance=conhost.exe,
user_input_delay_per_process,host=redacted,instance=explorer.exe,

i tested on regex101, the pattern had what i want

[[processors.regex]]
  namepass = ["user_input_delay_per_process"]
  [[processors.regex.tags]]
    key = "instance"
    pattern = "<(.+)\.exe\>$"
    replacement = "${1}"

but when i run telegraf it throw me an ** invalid TOML syntax** on the line of the pattern

i tested a simple one and no invalid TOML syntax

    pattern = "(.+)"

:slight_smile: any lights?

2

It is indeed wrong TOML syntax, what do you think of this instead?

[[processors.regex]]
  namepass = ["user_input_delay_per_process"]
  [[processors.regex.tags]]
    key = "instance"
    pattern = "<(.+)\\.exe\\>$"
    replacement = "${1}"

Or use singe quotes:

[[processors.regex]]
  namepass = ["user_input_delay_per_process"]
  [[processors.regex.tags]]
    key = "instance"
    pattern = '<(.+)\.exe\>$'
    replacement = "${1}"
3

Hello Hipska

i was so focus on the regex, that i though it’s an error in the regex the issue (forbidden character or else), even if it point to toml issue :frowning: .

Working both as a charm :slight_smile: .