# Elastic Agent exclude\_files error parsing regexp invalid nested repetition operator

**URL:** <https://discuss.elastic.co/t/elastic-agent-exclude-files-error-parsing-regexp-invalid-nested-repetition-operator/357649>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [April 17, 2024, 6:27pm UTC](https://discuss.elastic.co/t/elastic-agent-exclude-files-error-parsing-regexp-invalid-nested-repetition-operator/357649 "2024-04-17T18:27:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\
**Post date:** [April 17, 2024, 6:27pm UTC](https://discuss.elastic.co/t/elastic-agent-exclude-files-error-parsing-regexp-invalid-nested-repetition-operator/357649/1 "2024-04-17T18:27:21Z")

</div>

When using the exclude\_files processor I'm seeing the error:

> [elastic\_agent][error] Unit state changed (CONFIGURING-\>FAILED): error parsing regexp: invalid nested repetition operator: `**` accessing 'exclude\_files.0'

Through Kibana I'm editing the "Custom logs" integration and trying to edit the processors section so that we exclude a file path and any subdirectories under it as there are many. The configuration looks like:

> `exclude_files:`  
> ` - '/ctr/logs/Applications/George/**'`

- I guess the first question is do we use no, single or double quotes when implementing processor configs through Kibana.
- Second, how do I stop EA from harvesting that path and any following subdirectories? Or am I just going to have to put 9 different /\* rows in this?

---

<div class="post-metadata">

**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\
**Post date:** [April 17, 2024, 7:30pm UTC](https://discuss.elastic.co/t/elastic-agent-exclude-files-error-parsing-regexp-invalid-nested-repetition-operator/357649/2 "2024-04-17T19:30:16Z")

</div>

I got this working with:

```auto
exclude_files:
  - "/ctr/logs/Applications/George/*"
  - "/ctr/logs/Applications/George/*/*"
  - "/ctr/logs/Applications/George/*/*/*"
  - etc

```

Any insight on how to do it with more efficient syntax would be appreciated.