Search code examples
logstashterraformterraform-template-file

How to escape a Logstash sprintf expression in a Terraform template?


I am trying to template a logstash configuration which is using a sprintf expression using Terraform template file.

Example:

filter {
  json { source => "message" }
  geoip {
    source => "[user][rparam][ip]"
  }
  useragent {
    source => "[user][rparam][ua]"
  }
  date {
    match => [ "[@metadata][kafka][timestamp]", "UNIX_MS" ]
  }
  mutate { add_field => { "[@metadata][id]" => "%{[id]}" } }
  mutate { add_field => { "[@metadata][eid]" => "%{[eid]}" } }
  mutate { remove_field => [ "message", "id", "eid", "@version", "tags" ] }
  if "[user]" {
    mutate { remove_field => [ "[user][rparam][ip]" ] }
  }
}

Unfortunately, the percentage characters "%" used are also part of the Terraform template language, so Terraform returns the following error message to me:

* data.template_file.logstash-output: data.template_file.logstash-output: failed to render : <template_file>:6,24-25: Invalid character; This character is not used within the language., and 1 other diagnostic(s)

How can this be properly escaped? The Terraform documentation leaves no clue, and only specifies how to escape a variable interpolation expression ($)


Solution

  • The percentage character can be excaped with a double %%. The template file above can be written like so, and the Logstash sprintf expression will be properly processed in the result:

    filter {
      json { source => "message" }
      geoip {
        source => "[user][rparam][ip]"
      }
      useragent {
        source => "[user][rparam][ua]"
      }
      date {
        match => [ "[@metadata][kafka][timestamp]", "UNIX_MS" ]
      }
      mutate { add_field => { "[@metadata][id]" => "%%{[id]}" } }
      mutate { add_field => { "[@metadata][eid]" => "%%{[eid]}" } }
      mutate { remove_field => [ "message", "id", "eid", "@version", "tags" ] }
      if "[user]" {
        mutate { remove_field => [ "[user][rparam][ip]" ] }
      }
    }