td-agent-2.3.1-0.el6
CentOS 6
<source>
@type tail
path /var/log/minimal.log
pos_file /var/log/td-agent/pos/minimal-log.pos
tag minimal
format /(?(?=request:)request:(?<request>.*))/
</source>
<match **>
type bufferize
buffer_type file
buffer_path /var/log/td-agent/*.buffer
<config>
type secure_forward
secure true
shared_key ---------------
self_hostname ${hostname}
ca_cert_path /etc/td-agent/ssl/certs/ca_cert.pem
<server>
host fake.hostname.com
</server>
</config>
</match>
When I try to start td-agent, I get an error saying my conditional pattern is invalid.
# /etc/init.d/td-agent start
Starting td-agent: 2016-08-15 12:19:07 -0400 [error]: fluent/supervisor.rb:359:rescue in main_process: config error file="/etc/td-agent/td-agent.conf" error="Invalid regexp '(?(?=request:)request:(?<request>.*))': invalid conditional pattern: /(?(?=request:)request:(?<request>.*))/"
[FAILED]
This is also happens when I use Fluentular:
goo.gl/URE310
However, when I use regex101 to verify my statement, it works just fine.
https://regex101.com/r/lT9vW6/4
Could someone please point out my mistake or what's expected differently?
Ruby's regexp is not based on PCRE.
Your pattern is PCRE specific syntax, right?
It uses PCRE extended regular expression syntax.
I'm not sure what the differences between the syntaxes are in this case, but it was resolved with this small change:
format /((?=request:)request:(?<request>.*))/
Just so it's clear and in a same post to compare characters (also added a non capturing version for the global if):
Original non working
format /(?(?=request:)request:(?<request>.*))/
@robert-7 's version
format /((?=request:)request:(?<request>.*))/
non capturing global if
format /(?:(?=request:)request:(?<request>.*))/
Most helpful comment
Just so it's clear and in a same post to compare characters (also added a non capturing version for the global if):
Original non working
format /(?(?=request:)request:(?<request>.*))/@robert-7 's version
format /((?=request:)request:(?<request>.*))/non capturing global if
format /(?:(?=request:)request:(?<request>.*))/