1

I have a logstash config file that I need to convert to a chef erb template (mainly the filters section). However, I keep running into issues due to the format of the grok patterns. Below is an example of the grok pattern. 

  grok {
    match => ["message", "<%{POSINT:seqnum1}>%{POSINT:seqnum2}: (\d*: |\.|\*)*%{SYSLOGTIMESTAMP:timestamp} %{WORD:tz}: \%%{WORD:facility_label}-(%{WORD:switch_id}-)*%{INT:severity}-%{WORD:program}: %{GREEDYDATA:message}"]

Here is the issue. Shortly after this I need to have some interpolation fill in an IP address etc. But it wont because the <% starts an interpolation of its own. 

mutate {
  add_field => {"[@metadata][sentry][msg]" => "%{host}"
    "[@metadata][sentry][severity]" => "%{severity}"
    "[@metadata][sentry][host]" => "<%= @sentry_host[:ipaddress] %>"
    "[@metadata][sentry][pid]" => "<%= @sentry_pid %>"
    "[@metadata][sentry][key]" => "<%= @sentry_key %>"
    "[@metadata][sentry][secret]" => "<%= @sentry_secret %>"
  }
}

So all of the values above are processed as the string of <%= @sentry_... %>.

Is there a way to get around this? I have tried the escape method of <%%{POSINT:seqnum1}>%{POSINT:seqnum2}:%> seen here. But it still puts the closing %> in. Any other ways to escape characters/strings in ERB?

Thanks! Josh

Community
  • 1
  • 1
Joshua Zitting
  • 23
  • 2

1 Answers1

0

You don't want to put the %> in your text. <%% becomes a literal <% and it doesn't need a paired ending tag.

EDIT example of erb -x:

$ echo '<%% foo <%= asdf %> bar <%= baz %>' | erb -x
#coding:ASCII-8BIT
_erbout = ''; _erbout.concat "<% foo "; _erbout.concat(( asdf ).to_s); _erbout.concat " bar "; _erbout.concat(( baz ).to_s); _erbout.concat "\n"
; _erbout.force_encoding(__ENCODING__)
coderanger
  • 52,400
  • 4
  • 52
  • 75
  • Thanks for being on this so quickly! However if I do the <%% it wont interpolate anything until the close/ending "%>" AFTER the "@sentry_host[:ipaddress]" `"[@metadata][sentry][host]" => "<%= @sentry_host[:ipaddress] %>" "[@metadata][sentry][pid]" => "<%= @sentry_host[:ipaddress] %>"` ends up being ` "[@metadata][sentry][host]" => "<%= @sentry_host[:ipaddress] %>" "[@metadata][sentry][pid]" => "10.100.100.100"` – Joshua Zitting Jun 10 '16 at 21:54
  • It's a bit hard to follow this in a comment, but you can always pipe a snippet of Erb to `erb -x` to see the generated Ruby code, that should give you an idea of what's going on :) – coderanger Jun 10 '16 at 23:28