I am trying to template a logstash configuration which is using a sprintf expression using Terraform template file.
Example:
filter {
json { source => "message" }
geoip {
source => "[user][rparam][ip]"
}
useragent {
source => "[user][rparam][ua]"
}
date {
match => [ "[@metadata][kafka][timestamp]", "UNIX_MS" ]
}
mutate { add_field => { "[@metadata][id]" => "%{[id]}" } }
mutate { add_field => { "[@metadata][eid]" => "%{[eid]}" } }
mutate { remove_field => [ "message", "id", "eid", "@version", "tags" ] }
if "[user]" {
mutate { remove_field => [ "[user][rparam][ip]" ] }
}
}
Unfortunately, the percentage characters "%" used are also part of the Terraform template language, so Terraform returns the following error message to me:
* data.template_file.logstash-output: data.template_file.logstash-output: failed to render : <template_file>:6,24-25: Invalid character; This character is not used within the language., and 1 other diagnostic(s)
How can this be properly escaped? The Terraform documentation leaves no clue, and only specifies how to escape a variable interpolation expression ($)
The percentage character can be excaped with a double %%. The template file above can be written like so, and the Logstash sprintf expression will be properly processed in the result:
filter {
json { source => "message" }
geoip {
source => "[user][rparam][ip]"
}
useragent {
source => "[user][rparam][ua]"
}
date {
match => [ "[@metadata][kafka][timestamp]", "UNIX_MS" ]
}
mutate { add_field => { "[@metadata][id]" => "%%{[id]}" } }
mutate { add_field => { "[@metadata][eid]" => "%%{[eid]}" } }
mutate { remove_field => [ "message", "id", "eid", "@version", "tags" ] }
if "[user]" {
mutate { remove_field => [ "[user][rparam][ip]" ] }
}
}