Elastic Agent exclude_files error parsing regexp invalid nested repetition operator

Elastic Stack Elastic Agent
1

When using the exclude_files processor I'm seeing the error:

[elastic_agent][error] Unit state changed (CONFIGURING->FAILED): error parsing regexp: invalid nested repetition operator: ** accessing 'exclude_files.0'

Through Kibana I'm editing the "Custom logs" integration and trying to edit the processors section so that we exclude a file path and any subdirectories under it as there are many. The configuration looks like:

exclude_files:
- '/ctr/logs/Applications/George/**'

  • I guess the first question is do we use no, single or double quotes when implementing processor configs through Kibana.
  • Second, how do I stop EA from harvesting that path and any following subdirectories? Or am I just going to have to put 9 different /* rows in this?
2

I got this working with:

exclude_files:
  - "/ctr/logs/Applications/George/*"
  - "/ctr/logs/Applications/George/*/*"
  - "/ctr/logs/Applications/George/*/*/*"
  - etc

Any insight on how to do it with more efficient syntax would be appreciated.