[bug-hunter] filelog_otel multiline regex vars render invalid YAML when unquoted

Open Beginner friendly
#17,971 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
handlebars, python, yaml
Domain
backend, observability-sre

Research direction

Start with packages/filelog_otel/agent/input/input.yml.hbs and the multiline variable definitions in packages/filelog_otel/manifest.yml; run the provided Python reproduction to confirm the rendered YAML failure. Trace how these values are rendered and verify that valid multiline regex values produce parseable agent configuration without changing other multiline behavior.

Written by the indexing model from the issue text.

Description

Integration:filelog_otel

Impact

Users configuring filelog_otel multiline regex patterns can produce an invalid rendered input config, which prevents the input from starting. This is user-impacting because multiline regex is a documented setting, and valid regex patterns (e.g. date prefixes) cause parse failure.

Reproduction Steps

  1. Save and run this new minimal script:
import yaml

rendered = """receivers:
  filelog:
    multiline:
      line_start_pattern: [0-9]{4}-[0-9]{2}-[0-9]{2}
      omit_pattern: false
"""

print('--- Rendered YAML ---')
print(rendered)
print('--- Parse result ---')
yaml.safe_load(rendered)
  1. Run:
python /tmp/gh-aw/agent/repro_filelog_otel_yaml.py
  1. Observe deterministic parser failure.

Expected vs Actual

Expected: A valid multiline regex value should render into valid YAML and be parseable by the agent config loader.

Actual: YAML parsing fails with:

yaml.parser.ParserError: while parsing a block mapping
  in "(unicode string)", line 4, column 7:
          line_start_pattern: [0-9]{4}-[0- ...
          ^
expected (block end), but found '{'
  in "(unicode string)", line 4, column 32:
          line_start_pattern: [0-9]{4}-[0-9]{2}-[0-9]{2}
                                   ^

Failing Test

import yaml

rendered = """receivers:
  filelog:
    multiline:
      line_start_pattern: [0-9]{4}-[0-9]{2}-[0-9]{2}
      omit_pattern: false
"""

yaml.safe_load(rendered)

Evidence

  • Unquoted template rendering in packages/filelog_otel/agent/input/input.yml.hbs:
    • line_start_pattern: \{\{multiline_line_start_pattern}} (line 39)
    • line_end_pattern: \{\{multiline_line_end_pattern}} (line 44)
  • User-exposed multiline regex vars in packages/filelog_otel/manifest.yml:
    • multiline_line_start_pattern (line 195)
    • multiline_line_end_pattern (line 201)
  • No matching open duplicate found via issue search for filelog_otel + multiline + line_start_pattern.

What is this? | From workflow: Bug Hunter

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

  • expires on Mar 30, 2026, 11:30 AM UTC
Dominant language
Handlebars
Stars
334
Forks
652
Avg merge
1d 22h
Merged PRs (30d)
241

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from elastic/integrations

All issues in elastic/integrations

Similar issues

More Backend & API Design issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.