CODEWITHSUNDEEP
regexgoogle-cloud-platformterraformgoogle-cloud-logging
user1596707
user1596707

Reputation: 141

Regex Filter Error in google_logging_project_sink Terraform Script

I'm trying to create a Cloud Logging Sink with Terraform, that contains a regex as part of the filter.

textPayload=~ '^The request'

There have been many errors around the format of the regex, and I can't see anything in the documentation or other SO questions on how to properly create the script. Sinks are also not a valid option for a script generated by Terraformer, so I can't export the filter created via the UI

When including the regex as a standard string, the following error is thrown.

Unparseable filter: regular expressions must begin and end with '"' at line 1, column 106, token ''^The',

And when included as a variable with and without slash escapes variable "search" { default = "/^The request/" } there is the following:

Unparseable filter: unrecognized node at token 'MEMBER'

I'd be grateful for any tips, or links to documentation on how I would be able to include a regex as part of a logging filter.

Upvotes: 1

Views: 1154

Answers (1)

Cloudkollektiv
Cloudkollektiv

Reputation: 14669

The problem is not with your query, which is obviously a valid query to search google cloud logging. I think it is due to the fact that you are using another provider (Terraform) to deploy everything. Which will transform your string values and pass them to GCP as a JSON. We ran into a similar issue and it caused me some headaches as well. What we came up with was the following:

"severity>=ERROR AND NOT protoPayload.@type=\"type.googleapis.com/google.cloud.audit.AuditLog\" AND NOT (resource.type=\"cloud_scheduler_job\" AND jsonPayload.status=\"UNKNOWN\")"

Applying this logic to your query:

filter = "textPayload=~\"^The request\""

Another option is to exclude the quotes:

filter = "textPayload=~^The request"

Upvotes: 3

Related Questions