How to properly escape a single quote in the query surrounded by single quotes also

[alexku7]

Hello
Try my luck again.
Still fighting with the issue

filter: - query: query_string: query: 'kubernetes.container_name: proxy AND level: "ERROR shouldn't"'

The pod is crashing.
Unfortunately ,it's crashing also if I add the standard python escape character \ :

query: 'kubernetes.container_name: proxy AND level: "ERROR shouldn\'t"'

What could be a problem ?

[jertel]

Looks like you are missing a trailing single quote.

[alexku7]

Oh sorry @jertel . I missed it only in the question :)

In reality it's ok. I updated the initial post

[jertel]

We'll need the ElastAlert2 log showing the crash error to help you.

[alexku7]

sure
This is the error with the escape character, but the same error if I remove it

`Index elastalert already exists. Skipping index creation.
Traceback (most recent call last):

File "/usr/local/bin/elastalert", line 8, in
sys.exit(main())
File "/usr/local/lib/python3.10/site-packages/elastalert/elastalert.py", line 1862, in main
client = ElastAlerter(args)
File "/usr/local/lib/python3.10/site-packages/elastalert/elastalert.py", line 127, in init
self.rules = self.rules_loader.load(self.conf, self.args)
File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 166, in load
rule = self.load_configuration(rule_file, conf, args)
File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 227, in load_configuration
rule = self.load_yaml(filename)
File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 251, in load_yaml
loaded = self.get_yaml(current_path)
File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 578, in get_yaml
return read_yaml(filename)
File "/usr/local/lib/python3.10/site-packages/elastalert/yaml.py", line 8, in read_yaml
return yaml.load(yamlContent, Loader=yaml.FullLoader)
File "/usr/local/lib/python3.10/site-packages/yaml/init.py", line 81, in load
return loader.get_single_data()
File "/usr/local/lib/python3.10/site-packages/yaml/constructor.py", line 49, in get_single_data
node = self.get_single_node()
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 36, in get_single_node
document = self.compose_document()
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 55, in compose_document
node = self.compose_node(None, None)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 133, in compose_mapping_node
item_value = self.compose_node(node, item_key)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 82, in compose_node
node = self.compose_sequence_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 111, in compose_sequence_node
node.value.append(self.compose_node(node, index))
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 133, in compose_mapping_node
item_value = self.compose_node(node, item_key)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 133, in compose_mapping_node
item_value = self.compose_node(node, item_key)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 127, in compose_mapping_node
while not self.check_event(MappingEndEvent):
File "/usr/local/lib/python3.10/site-packages/yaml/parser.py", line 98, in check_event
self.current_event = self.state()
File "/usr/local/lib/python3.10/site-packages/yaml/parser.py", line 438, in parse_block_mapping_key
raise ParserError("while parsing a block mapping", self.marks[-1],
yaml.parser.ParserError: while parsing a block mapping
in "", line 14, column 9:
query: 'kubernetes.container_nam ...
^
expected , but found ''
in "", line 14, column 77:
... roxy AND level: "ERROR shouldn't"'
^`

[jertel]

You can either write it as one of the following:

1. query: 'kubernetes.container_name: proxy AND level: "ERROR shouldn''t"'

or

2. query: "kubernetes.container_name: proxy AND level: \"ERROR shouldn't\""

[alexku7]

so putting the quote twice will do the magic?

Thanks, I will try :)