Syntax highlighting doesn't seem to support escaping quotation marks

[WToorenburghIntiveo]

VSCode version: 1.22.2 Logstash plugin version: 0.0.3

I was looking at the Filebeat configuration examples for Logstash, and copied over the Nginx module filter config to try out for myself. When I pasted it in, I noticed that this grok statement had some unformatted text inside the string:

grok {
        match => { "message" => ["%{IPORHOST:[nginx][access][remote_ip]} - %{DATA:[nginx][access][user_name]} \[%{HTTPDATE:[nginx][access][time]}\] \"%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}\" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} \"%{DATA:[nginx][access][referrer]}\" \"%{DATA:[nginx][access][agent]}\""] }
        remove_field => "message"
      }

[zeleznypa]

There is also an issue in syntax highlight in regexp like

filter {
    if [log_text] =~ /exception \'OutputNotReadyException\'/ {
        mutate {
            replace => {
                "log_type" => "D"
            }
        }
    }
}

[randomchance]

I don't actually use logstash currently, and don't have much time to dig into it right now, however if you can make a pull request I'll get it merged and published.

[zeleznypa]

Im not familiar with the VSCode extensions, but for someone who want to fix it, the regexp for matching the "Regular expression string" can be following

=~(?:\s)+(?P<regex>(?P<delimiter>[\/~@;%`])(?:.*?)(?<!\\)(?:\2))(?:\s)+

You can test it on the code pasted before on https://regex101.com/

[joecullin]

I ran into the same thing with a double quote in a regular expression. If there's an odd number of double quotes, the rest of the file loses its syntax highlighting.

I found an ok workaround: in a comment, replicate the closing/opening characters for the remainder of that line. For example:

  if ([message] =~ /id=[a-zA-Z0-9_-]+\s+sn=[a-zA-Z0-9_-]+\stime=\"[0-9]{4}-[0-9]{1,2}-[0-9]{1,2} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/){
    #"){ <-- vscode syntax highlighting workaround for double quote in regex
    mutate { add_field => { 'dataset' => "xxxx" } }
  }

It won't fix the highlighting for the remainder of the broken line, but it will limit the impact to that one line.