regular expression has ']' without escape warning in nginx_ingress_controller error pipeline

[matschaffer]

integrations/packages/nginx_ingress_controller/data_stream/error/elasticsearch/ingest_pipeline/default.yml

Line 17 in ce91bf3

- '%{LOG_LEVEL:log.level}%{MONTHNUM2:timestamp_month}%{MONTHDAY:timestamp_day} %{HOUR:timestamp_hour}:%{MINUTE:timestamp_minute}:%{SECOND:timestamp_second}.%{NANOS:timestamp_nano}%{SPACE}%{NUMBER:nginx_ingress_controller.error.thread_id} %{SOURCE_FILE:nginx_ingress_controller.error.source.file}:%{NUMBER:nginx_ingress_controller.error.source.line_number}] %{GREEDYMULTILINE:message}'

contains an unescaped ]

I'm not familiar with the integration or what's expected, but regular expressions would need ] to come after a [ or be escaped if the intention is to match a literal square bracket.

I think in this case the literal square bracket may be intended.

Rel: #472
Rel: #467

[TheRiffRafi]

Indeed the intention is to match the end bracket, example log

[legoguy1000]

No that is fine. It will only need to be escaped if there is both open and closing bracket, then regex interprets it as a range of characters. Just a single ] isn't an issue and doesn't need to be escaped. Are u actually seeing an error somewhere? I just tested the current grok pattern without issue.

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[willem-dhaese]

We have huge amount of errors like these when Elasticsearch restarts:

regular expression has ']' without escape

Seems to be related to multiple builtin ingest pipelines containing ] without escape..

[maggieghamry]

Still seeing this as of June 2024