logparser: regexp with lookahead

[ma2thieu]

Bug report

I want to filter out all the logs from bots, so I setup a custom pattern with a regex that only match user-agent that don't contain the words "bot" and "crawl"

Relevant telegraf.conf:

NOBOT ((?!bot|crawl).)*
COMBINED_GEOIP_LOG_FORMAT %{CLIENT:client_ip} %{NOTSPACE:ident:drop} %{NOTSPACE:auth:drop} \[%{HTTPDATE:ts:ts-httpd}\] "(?:%{WORD:verb:tag} %{NOTSPACE:request}(?: HTTP/%{NUMBER:http_version:drop})?|%{DATA})" %{NUMBER:resp_code:tag} (?:%{NUMBER:resp_bytes:drop}|-) %{QS:referrer:drop} "%{NOBOT:agent:drop}" %{QS:country_code:tag} %{QS:country_name:drop}

System info:

Telegraf v1.1.1
Debian 8

Steps to reproduce:

telegraf -config /etc/telegraf/telegraf.conf

Expected behavior:

import only logs where agent doesn't contain the word bot or crawl

Actual behavior:

import nothing

Additional info:

http://stackoverflow.com/questions/41180872/custom-pattern-to-drop-bots-when-importing-logs-into-influxdb/41189447#41189447

[sparrc]

I don't think we'll be able to do much unless Go itself supports lookaheads, but we should at least return an error message if the regex pattern compile fails as it does here.