var substitution failed for 'vector-ecs-transformation': YAMLToJSON: YAMLToJSON: found unknown escape character

[shreyasarani23]

Below is vector remap function and I am getting the error, found unknown escape character. Is there any issue in the regex expression while the yaml is been parsed? How to resolve this issue?

pre-s3-enrichment:
  type: remap
  inputs:
  - ecs-encrichment-os
  - opswork-encrichment-os
  - rds-encrichment-os
  source: |
    if includes(["service-x", "service-y", "service-z", "service-a, "service-b"], .service.name) {
      drop_condition = false
      if (exists(."service-x".uri) && !match(to_string!(."service-x".uri), r'.*/(ns)/(v\d+)/(account)/([A-Za-z0-9]+)/(number).*')) ||
         (exists(."service-y".http_user_agent) && match(to_string!(."service-y".http_user_agent), r'.*/(ELB-HealthChecker)/.*')) ||
         (exists(."service-z".http_user_agent) && match(to_string!(."service-z.http_user_agent), r'.*/(ELB-HealthChecker)/.*')) ||
         (exists(.service-a.uri) && match(to_string!(.service-a.uri), r'.*/(status)')) ||
         (includes(["service-a", "service-b"], .service.name) && exists(.message) && 
             !(match(to_string!(.message), r'.*initiating rejection of EightMSPortOutNumbers.*') || 
               match(to_string!(.message), r'.*UpdatePortOutOrderDetails:port out orderID:.*') || 
               match(to_string!(.message), r'.*performing default action on order.*') || 
               match(to_string!(.message), r'.*PortOutCustomerResponse:.*')))
      {
        drop_condition = true
      }
      if (drop_condition) {
        abort
      } else {
        . = {
          "message": .message,
          "service": .service,
          "error": .error,
          "@timestamp": ."@timestamp",
          "event": .event
        }
      }
    }

[pront]

Hi @shreyasarani23, this looks like a malformed Rust regex. Did you test if your regexes work outside of VRL?

[shreyasarani23]

Hi @pront thanks for the response. Actually I was able to correct the regex by adding double \\ in this particular line

 if (exists(."service-x".uri) && !match(to_string!(."service-x".uri), r'.*/(ns)/(v\\d+)/(account)/([A-Za-z0-9]+)/(number).*')) ||

since yaml has it's own escaping rules we need use double \\