diff --git a/modules/s3-logfile/main.tf b/modules/s3-logfile/main.tf index 299cd5f..754701e 100644 --- a/modules/s3-logfile/main.tf +++ b/modules/s3-logfile/main.tf @@ -56,6 +56,7 @@ module "s3_processor" { environment_variables = { PARSER_TYPE = var.parser_type + REGEX_PATTERN = var.regex_pattern FORCE_GUNZIP = true ENVIRONMENT = var.environment HONEYCOMB_WRITE_KEY = var.honeycomb_api_key diff --git a/modules/s3-logfile/variables.tf b/modules/s3-logfile/variables.tf index d36fa47..916ea7b 100644 --- a/modules/s3-logfile/variables.tf +++ b/modules/s3-logfile/variables.tf @@ -82,11 +82,18 @@ variable "parser_type" { description = "The type of logfile to parse." validation { // ref: https://github.com/honeycombio/agentless-integrations-for-aws/blob/5f530c296035c61067a6a418d6a9ab14d34d7d79/common/common.go#L129-L153 - condition = contains(["alb", "elb", "s3-access", "vpc-flow", "cloudfront", "json", "keyval"], var.parser_type) - error_message = "parser_type must be one of the allowed values" + condition = contains(["alb", "elb", "s3-access", "vpc-flow", "cloudfront", "json", "keyval", "regex"], var.parser_type) + error_message = "parser_type must be one of the allowed values." } } +variable "regex_pattern" { + # This variable depends on "parser_type". In tf < 1.9, validation cannot use another variable. + type = string + description = "Arbitrary regex pattern used to parse logfile. parser_type must be set to regex for this pattern to be used. Honeycomb columns are generated by defining named capture groups. For example, `(?P[a-z]+)` would create a column called 'name' if successfully parsed." + default = "" +} + variable "rename_fields" { type = map(string) description = "Map of fields to rename, old -> new."