Agent does not start when exclude_logs processor is used

[vohtaski]

We would like to filter out all syslog logs that are not relevant for our service.

We followed this guide and below is our configuration: https://cloud.google.com/stackdriver/docs/solutions/agents/ops-agent/configuration#logging-processors

Process starts with this configuration

logging:
  receivers:
    syslog:
      type: files
      include_paths:
      - /var/log/syslog
  processors:
    parser_syslog:
      type: exclude_logs
      match_any: ['jsonPayload.message =~ "otelopscol"']
  service:
    pipelines:
      default_pipeline:
        receivers: []
      pipeline-syslog:
        receivers: [syslog]
        #processors: [parser_syslog]

However, whenever we uncomment this line "processors: [parser_syslog]", the process fails to start.

logging:
  receivers:
    syslog:
      type: files
      include_paths:
      - /var/log/syslog
  processors:
    parser_syslog:
      type: exclude_logs
      match_any: ['jsonPayload.message =~ "otelopscol"']
  service:
    pipelines:
      default_pipeline:
        receivers: []
      pipeline-syslog:
        receivers: [syslog]
        processors: [parser_syslog]

Not sure what is wrong.

Version of Agent:

nginx:~$ dpkg-query --show --showformat \
    '${Package} ${Version} ${Architecture} ${Status}\n' \
     google-cloud-ops-agent
google-cloud-ops-agent 2.10.0~ubuntu20.04 amd64 install ok installed

[jefferbrecht]

This appears to be caused by having hyphens in the pipeline name. From /var/log/google-cloud-ops-agent/subagents/logging-module.log:

[2022/02/25 16:51:02] [error] [record accessor] bad input character '-' at line 0
[2022/02/25 16:51:02] [error] [record accessor] syntax error, unexpected IDENTIFIER, expecting $end at '$__match_pipeline-syslog_syslog'
[2022/02/25 16:51:02] [error] [filter:grep:grep.2] invalid record accessor? '$__match_pipeline-syslog_syslog'
[2022/02/25 16:51:02] [error] Failed initialize filter grep.2

For now, please try renaming pipeline-syslog to pipeline_syslog as a workaround. I will see if we can put in a fix for this in a future release. Thanks for the report!