# CRIT Exiting: No prospectors defined. What files do you want me to watch?

**URL:** <https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 3, 2017, 2:05pm UTC](https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728 "2017-08-03T14:05:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hasan\_sharekhan](https://avatars.discourse-cdn.com/v4/letter/h/eada6e/32.png) [@hasan\_sharekhan](https://discuss.elastic.co/u/hasan_sharekhan)\
**Post date:** [August 3, 2017, 2:05pm UTC](https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728/1 "2017-08-03T14:05:28Z")

</div>

I am having problem with regular expression not working in filebeat 5.5

```
filebeat.prospectors:
- input_type: log

  paths:
    - D:\uat\beats\filebeat550\input_logs\tt_tradingserver\*

  #use regular expression
  exclude_files: ["TradingServer_.*Copy.*\.log$|TradingServer_[0-9]+Jun17.log$|TradingServer_[0-9]+Jul17.log$"]

```

I am excluding all logs files having Jul17, Jul17 and the word 'Copy' in its name

Below is the list of files available in the directory

> TradingServer\_01Aug17.log  
> TradingServer\_01Jul17.log  
> TradingServer\_01Jun17.log  
> TradingServer\_02Aug17.log  
> TradingServer\_02Jun17.log  
> TradingServer\_03Aug17.log  
> TradingServer\_03Jul17.log  
> TradingServer\_04Jul17.log  
> TradingServer\_04Jun17.log  
> TradingServer\_05Jul17.log  
> TradingServer\_05Jun17.log  
> TradingServer\_06Jul17.log  
> TradingServer\_06Jun17.log  
> TradingServer\_07Jul17.log

But I am getting an error as

> CRIT Exiting: No prospectors defined. What files do you want me to watch?

I have checked this regular expression in EditPlus as well on regular expression validation websites it is working fine there but not in FileBeats

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 3, 2017, 2:53pm UTC](https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728/2 "2017-08-03T14:53:25Z")

</div>

> [@hasan\_sharekhan](#):
>
> CRIT Exiting: No prospectors defined. What files do you want me to watch?

That error doesn't indicate a problem with the regular expression. Are you sure it's the regular expression causing the error? Can you please comment out the `exclude_lines` and see if the error persists.

BTW We recommend that you wrap regular expressions in single quotation marks to work around YAML’s string escaping rules. (see [Regular Expression Support](https://www.elastic.co/guide/en/beats/filebeat/5.5/regexp-support.html))

---

<div class="post-metadata">

**Author:** ![hasan\_sharekhan](https://avatars.discourse-cdn.com/v4/letter/h/eada6e/32.png) [@hasan\_sharekhan](https://discuss.elastic.co/u/hasan_sharekhan)\
**Post date:** [August 4, 2017, 5:38am UTC](https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728/3 "2017-08-04T05:38:41Z")

</div>

Hi,

Without exclude\_files it is working and it is also working with below excludes\_files

`exclude_files: ["TradingServer_[0-9]+Jun17.log$|TradingServer_[0-9]+Jul17.log$"]`

but when i add below expression then only i am getting error.

`TradingServer_.*Copy.*\.log$|`

---

<div class="post-metadata">

**Author:** ![hasan\_sharekhan](https://avatars.discourse-cdn.com/v4/letter/h/eada6e/32.png) [@hasan\_sharekhan](https://discuss.elastic.co/u/hasan_sharekhan)\
**Post date:** [August 4, 2017, 6:27am UTC](https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728/4 "2017-08-04T06:27:39Z")

</div>

Now it is working absolutely fine, used single quote, stopped using | pipe sign, and made each regular expression separate

`exclude_files: ['TradingServer_.*Copy.*\.log$', 'TradingServer_[0-9]+Jun17.log$', 'TradingServer_[0-9]+Jul17.log$']`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2017, 6:28am UTC](https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728/5 "2017-09-01T06:28:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.