Issue adding configuration for sidecar

So, I’m getting the following error while trying to add a collector configuration:

Template error: Syntax error in template "cb934a71-d70e-49d2-9db8-e0f5313035d0" in line 15, column 194: Encountered ":", but was expecting one of: "." ".." <DOT_DOT_LESS> "..*" "?" "??" "!" "[" "(" "}" <TERMINATING_EXCLAM>

I’m not sure what the issue, as the configuration works fine when I run it manually.

Config:

# Graylog syslog-ng collector
@version: 3.13
@include "scl.conf"

# Options
options {
    ts-format(iso);
    use_dns(no);
    use_fqdn(yes);
    flush_lines(0);
    keep_hostname(yes);
    chain_hostnames(no);
};

template-function "format-gelf-v2" "$(format-json version='1.1' host='${HOST}' short_message='${MSG}' level=int(${LEVEL_NUM}) timestamp=int64(${R_UNIXTIME}) _program='${PROGRAM}' _pid=int(${PID:-0}) _facility='${FACILITY}' _class='${.classifier.class}' --key .* --key _*)$(binary 0x00)";

destination d_graylog {
    network(
        "<hostname>"
        port("12201")
        transport("tls")
        tls(
            ca-dir("/etc/ssl/certs")
            peer-verify("required-untrusted")
        )
        template("$(format-gelf-v2)")
    );
};

# logs to send
log {
    source(s_local);
    source(s_clients);
    destination(d_graylog);
};

# Sources
source s_local{
    internal();
    system();
    file("/proc/kmsg" program_override("kernel"));
};

source s_clients {
    network(
        ip(0.0.0.0)
        port(514)
        transport("udp")
    );
};

is there maybe some way to escape this or something?

Aha. Figured it out. Rewrote the template-function as

template-function "format-gelf-v2" "$(format-json version='1.1' host='${'$'}{HOST}' short_message='${'$'}{MSG}' level=int(${'$'}{LEVEL_NUM}) timestamp=int64(${'$'}{R_UNIXTIME}) _program='${'$'}{PROGRAM}' _pid=int(${'$'}{PID:-0}) _facility='${'$'}{FACILITY}' _class='${'$'}{.classifier.class}' --key .* --key _*)$(binary 0x00)";

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.