Fix Prometheus $digit escape for OTel expandconverter

translator/tocwconfig/sampleConfig/opentelemetry/combined_v1_v2_ec2_config.yaml

@@ -1386,6 +1386,14 @@ receivers:
                   honor_timestamps: true
                   job_name: test_app
                   metrics_path: /metrics
+                  relabel_configs:
+                    - action: replace
+                      regex: (.*)
+                      replacement: $$1
+                      separator: ;
+                      source_labels:
+                        - __meta_kubernetes_pod_name
+                      target_label: pod
                   scheme: http
                   scrape_interval: 30s
                   scrape_protocols:
@@ -1553,12 +1561,12 @@ service:
                 - ec2tagger
                 - awsentity/resource
             receivers:
-                - telegraf_cpu
-                - telegraf_processes
                 - telegraf_mem
                 - telegraf_netstat
                 - telegraf_disk
                 - telegraf_procstat/1917393364
+                - telegraf_cpu
+                - telegraf_processes
                 - telegraf_swap
         metrics/host_metrics:
             exporters:
@@ -1574,8 +1582,8 @@ service:
                 - ec2tagger
                 - awsentity/service/telegraf
             receivers:
-                - telegraf_statsd
                 - telegraf_socket_listener
+                - telegraf_statsd
         metrics/hostDeltaMetrics:
             exporters:
                 - awscloudwatch
@@ -1584,8 +1592,8 @@ service:
                 - ec2tagger
                 - awsentity/resource
             receivers:
-                - telegraf_net
                 - telegraf_diskio
+                - telegraf_net
         metrics/opentelemetry:
             exporters:
                 - otlphttp/metrics

translator/tocwconfig/sampleConfig/opentelemetry/combined_v1_v2_eks_config.yaml

@@ -587,9 +587,9 @@ processors:
         ec2_instance_tag_keys:
             - AutoScalingGroupName
         ec2_metadata_tags:
+            - InstanceType
             - ImageId
             - InstanceId
-            - InstanceType
         imds_retries: 1
         middleware: agenthealth/statuscode
         refresh_tags_interval: 0s
@@ -2081,6 +2081,14 @@ receivers:
                   honor_timestamps: true
                   job_name: test_app
                   metrics_path: /metrics
+                  relabel_configs:
+                    - action: replace
+                      regex: (.*)
+                      replacement: $$1
+                      separator: ;
+                      source_labels:
+                        - __meta_kubernetes_pod_name
+                      target_label: pod
                   scheme: http
                   scrape_interval: 30s
                   scrape_protocols:
@@ -2418,13 +2426,13 @@ service:
                 - ec2tagger
                 - awsentity/resource
             receivers:
-                - telegraf_swap
-                - telegraf_mem
+                - telegraf_procstat/1917393364
                 - telegraf_processes
-                - telegraf_netstat
                 - telegraf_disk
-                - telegraf_procstat/1917393364
+                - telegraf_mem
                 - telegraf_cpu
+                - telegraf_swap
+                - telegraf_netstat
         metrics/host_metrics:
             exporters:
                 - forward/opentelemetry
@@ -2449,8 +2457,8 @@ service:
                 - ec2tagger
                 - awsentity/resource
             receivers:
-                - telegraf_net
                 - telegraf_diskio
+                - telegraf_net
         metrics/opentelemetry:
             exporters:
                 - otlphttp/metrics

translator/tocwconfig/sampleConfig/opentelemetry/prometheus_otel_pipeline_config.yaml

@@ -390,6 +390,14 @@ receivers:
                   honor_timestamps: true
                   job_name: test_app
                   metrics_path: /metrics
+                  relabel_configs:
+                    - action: replace
+                      regex: (.*)
+                      replacement: $$1
+                      separator: ;
+                      source_labels:
+                        - __meta_kubernetes_pod_name
+                      target_label: pod
                   scheme: http
                   scrape_interval: 30s
                   scrape_protocols:

translator/tocwconfig/sampleConfig/opentelemetry/prometheus_otel_pipeline_eks_config.yaml

@@ -552,6 +552,14 @@ receivers:
                   honor_timestamps: true
                   job_name: test_app
                   metrics_path: /metrics
+                  relabel_configs:
+                    - action: replace
+                      regex: (.*)
+                      replacement: $$1
+                      separator: ;
+                      source_labels:
+                        - __meta_kubernetes_pod_name
+                      target_label: pod
                   scheme: http
                   scrape_interval: 30s
                   scrape_protocols:

translator/tocwconfig/sampleConfig/opentelemetry/prometheus_otel_scrape_config.yaml

@@ -5,3 +5,8 @@ scrape_configs:
   - job_name: 'test_app'
     static_configs:
       - targets: ['localhost:9090']
+    relabel_configs:
+      - source_labels: [__meta_kubernetes_pod_name]
+        regex: (.*)
+        target_label: pod
+        replacement: $1

translator/tocwconfig/tocwconfig_unix_test.go

@@ -177,6 +177,7 @@ func TestCombinedV1V2EKSConfig(t *testing.T) {
 	yamlConfig, err := mapstructure.Marshal(cfg)
 	require.NoError(t, err)
 	yamlStr := toyamlconfig.ToYamlConfig(yamlConfig)
+	// assert.NoError(t, os.WriteFile("./sampleConfig/opentelemetry/combined_v1_v2_eks_config.yaml", []byte(yamlStr), 0644)) // useful for regenerating YAML
 	require.NoError(t, yaml.Unmarshal([]byte(yamlStr), &actual))
 
 	opt := cmpopts.SortSlices(func(x, y interface{}) bool {

translator/translate/otel/pipeline/opentelemetry/prometheus/dollar_escape_test.go

@@ -0,0 +1,36 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: MIT
+
+package prometheus
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEscapeDollarDigit(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{name: "bare $1", in: "replacement: $1", want: "replacement: $$1"},
+		{name: "bare $0", in: "$0", want: "$$0"},
+		{name: "bare $9", in: "value=$9", want: "value=$$9"},
+		{name: "multiple refs", in: "$1 and $2 and $3", want: "$$1 and $$2 and $$3"},
+		{name: "already escaped $$1", in: "$$1", want: "$$$1"},
+		{name: "dollar non-digit", in: "$HOME and $PATH", want: "$HOME and $PATH"},
+		{name: "no dollar", in: "no dollars here", want: "no dollars here"},
+		{name: "empty string", in: "", want: ""},
+		{name: "dollar at end", in: "trailing$", want: "trailing$"},
+		{name: "multi-digit $10", in: "$10", want: "$$10"},
+		{name: "mixed text", in: "tag: k8s.label.$1 and $FOO", want: "tag: k8s.label.$$1 and $FOO"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := escapeDollarDigit(tt.in)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

translator/translate/otel/pipeline/opentelemetry/prometheus/translator.go

@@ -103,18 +103,14 @@ func (t *prometheusReceiverTranslator) Translate(conf *confmap.Conf) (component.
 		return nil, fmt.Errorf("unable to read prometheus config from path %s: %w", configPath, err)
 	}
 
+	// Prevent OTel expandconverter from misinterpreting Prometheus regex backreferences.
+	escaped := escapeDollarDigit(string(content))
 	var stringMap map[string]interface{}
-	if err := yaml.Unmarshal(content, &stringMap); err != nil {
+	if err := yaml.Unmarshal([]byte(escaped), &stringMap); err != nil {
 		return nil, fmt.Errorf("unable to parse prometheus config from %s: %w", configPath, err)
 	}
 
 	componentParser := confmap.NewFromStringMap(stringMap)
-	// NOTE: Prometheus relabel configs use $1, $2 for capture group references.
-	// The OTel confmap expandconverter interprets these as environment variable
-	// references (os.Expand), which can cause failures or empty replacements.
-	// This is a known limitation when prometheus configs with relabel_configs
-	// are loaded through the OTel config resolver pipeline.
-
 	var promCfg prometheusreceiver.PromConfig
 	if err := componentParser.Unmarshal(&promCfg); err != nil {
 		return nil, fmt.Errorf("unable to unmarshal prometheus config from %s: %w", configPath, err)
@@ -125,3 +121,17 @@ func (t *prometheusReceiverTranslator) Translate(conf *confmap.Conf) (component.
 
 	return cfg, nil
 }
+
+// escapeDollarDigit escapes bare $ followed by a digit so the expandconverter
+// does not interpret regex backreferences (e.g., $1 in relabel_configs) as env vars.
+func escapeDollarDigit(s string) string {
+	var out []byte
+	for i := 0; i < len(s); i++ {
+		if s[i] == '$' && i+1 < len(s) && s[i+1] >= '0' && s[i+1] <= '9' {
+			out = append(out, '$', '$')
+		} else {
+			out = append(out, s[i])
+		}
+	}
+	return string(out)
+}

translator/translate/otel/pipeline/opentelemetry/prometheus/translator_test.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/open-telemetry/opentelemetry-collector-contrib/receiver/prometheusreceiver"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/collector/confmap"
@@ -162,6 +163,50 @@ func TestPrometheusReceiverTranslator(t *testing.T) {
 	assert.NotNil(t, cfg)
 }
 
+func TestPrometheusReceiverTranslatorDollarEscape(t *testing.T) {
+	// Create a prometheus config with relabel_configs that use $1 capture group references.
+	// Without escaping, the OTel expandconverter would treat $1 as an env var and blank it out.
+	content := []byte(`scrape_configs:
+  - job_name: k8s_pods
+    relabel_configs:
+      - source_labels: [__meta_kubernetes_pod_name]
+        regex: (.*)
+        target_label: pod
+        replacement: $1
+      - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
+        regex: ([^:]+)(?::\d+)?;(\d+)
+        target_label: __address__
+        replacement: $1:$2
+`)
+	dir := t.TempDir()
+	path := filepath.Join(dir, "prometheus_relabel.yml")
+	require.NoError(t, os.WriteFile(path, content, 0600))
+
+	conf := confmap.NewFromStringMap(map[string]interface{}{
+		"opentelemetry": map[string]interface{}{
+			"collect": map[string]interface{}{
+				"prometheus": map[string]interface{}{
+					"config_path": path,
+				},
+			},
+		},
+	})
+
+	receiver := &prometheusReceiverTranslator{}
+	cfg, err := receiver.Translate(conf)
+	require.NoError(t, err)
+
+	promCfg := cfg.(*prometheusreceiver.Config)
+	require.Len(t, promCfg.PrometheusConfig.ScrapeConfigs, 1)
+
+	relabelCfgs := promCfg.PrometheusConfig.ScrapeConfigs[0].RelabelConfigs
+	require.Len(t, relabelCfgs, 2)
+	// $$1 is the correct value at this stage — the expandconverter resolves $$1 → $1 at
+	// collector startup. Without the escape, $1 would be treated as an env var and blanked out.
+	assert.Equal(t, "$$1", relabelCfgs[0].Replacement, "first relabel $1 should be escaped to $$1 for expandconverter")
+	assert.Equal(t, "$$1:$$2", relabelCfgs[1].Replacement, "second relabel $1:$2 should be escaped to $$1:$$2 for expandconverter")
+}
+
 func TestPrometheusReceiverTranslatorMissingFile(t *testing.T) {
 	conf := confmap.NewFromStringMap(map[string]interface{}{
 		"opentelemetry": map[string]interface{}{