Exclude archive files from filebeat processing

Elastic Stack Beats
1

Dear all,

I need exclude archive files from filebeat processing.

My archive exstensions: *.gz, *.bz2

Currently i have configured exclusion of such type of files, but it is not working.

exclude_files: [".gz$",".out$",".bz2$"]

Quick response will be greatly appreciated.

2

See here for an example: https://www.elastic.co/guide/en/beats/filebeat/5.3/configuration-filebeat-options.html#exclude-files You probably have the escape the dot.

3

Is there any differences between ['.gz$','.bz2$'] and [".gz$",".bz2$"] ?

4

Yes, single and double quotes can matter.