elastic / elastic/integrations
[bug-hunter] filelog_otel multiline regex vars render invalid YAML when unquoted
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
## Impact
Users configuring `filelog_otel` multiline regex patterns can produce an invalid rendered input config, which prevents the input from starting. This is user-impacting because multiline regex is a documented setting, and valid regex patterns (e.g. date prefixes) cause parse failure.
## Reproduction Steps
1. Save and run this new minimal script:
```python
import yaml
rendered = """receivers:
filelog:
multiline:
line_start_pattern: [0-9]{4}-[0-9]{2}-[0-9]{2}
omit_pattern: false
"""
print('--- Rendered YAML ---')
print(rendered)
print('--- Parse result ---')
yaml.safe_load(rendered)
```
2. Run:
```bash
python /tmp/gh-aw/agent/repro_filelog_otel_yaml.py
```
3. Observe deterministic parser failure.
## Expected vs Actual
**Expected:** A valid multiline regex value should render into valid YAML and be parseable by the agent config loader.
**Actual:** YAML parsing fails with:
```text
yaml.parser.ParserError: while parsing a block mapping
in "(unicode string)", line 4, column 7:
line_start_pattern: [0-9]{4}-[0- ...
^
expected (block end), but found '{'
in "(unicode string)", line 4, column 32:
line_start_pattern: [0-9]{4}-[0-9]{2}-[0-9]{2}
^
```
## Failing Test
```python
import yaml
rendered = """receivers:
filelog:
multiline:
line_start_pattern: [0-9]{4}-[0-9]{2}-[0-9]{2}
omit_pattern: false
"""
yaml.safe_load(rendered)
```
## Evidence
- Unquoted template rendering in `packages/filelog_otel/agent/input/input.yml.hbs`:
- `line_start_pattern: \{\{multiline_line_start_pattern}}` (line 39)
- `line_end_pattern: \{\{multiline_line_end_pattern}}` (line 44)
- User-exposed multiline regex vars in `packages/filelog_otel/manifest.yml`:
- `multiline_line_start_pattern` (line 195)
- `multiline_line_end_pattern` (line 201)
- No matching open duplicate found via issue search for `filelog_otel` + `multiline` + `line_start_pattern`.
---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Bug Hunter](https://github.com/elastic/integrations/actions/runs/23434663740)
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Mar 30, 2026, 11:30 AM UTC
Contributor guide
Assessment
This issue has not been assessed yet.