Can logstash be limited by subdirectories?

Elastic Stack Logstash
1

I have a list of subdirectories that are consistent in each directory. Is it possible to limit logstash to only look for those subdirectories and pull data from those? Would something like this work?

filter {
 if [type] == "log" {
   grok { match => { "path" => "/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA:folder}**/subDirectory1"} }
 grok { match => { "path" => "/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA:folder}**/subDirectory2"} }
grok { match => { "path" => "/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA:folder}**/subDirectory3"} }
   grok { match => { "path" => "%{GREEDYDATA}/{GREEDYDATA:filename}\log.json"} }
 }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.