Configure regex in promtail

Hi there,

I’m using promtail 2.9.7 and I have a specific use case with promtail. I want to send only the ERROR log. so I came up with this pattern to match the other log and drop it ^(?!.*ERROR).* You can test it by yourself, it only matches any other line but ERROR.

this is my promtail configuration

scrape_configs:
- job_name: system
  static_configs:
  - targets:
      - localhost
    labels:
      job: application
      __path__: /var/log/gitlab/gitlab-rails/application_json.log

  pipeline_stages:
    - drop:
        expression: "^(?!.*ERROR).*"

after I restarted the service, I got many of these errors referring to the drop section

invalid drop stage config: drop stage regex compilation error: error parsing regexp: invalid or unsupported Perl syntax: `(?!`"

Does this happen because promtail can’t understand the regex pattern? if so, how should I change it so promtail can understand?

Thanks

I think this was right. because, when I tried to use an alternative pattern like [^[^E]*([E][^R]|[^E])*$], it worked. i test it to match the DEBUG log level only [^[^D]*([D][^E]|[^D])*$] and the dashboard really shows DEBUG only while there are many INFO logs too