Exclude archive files from filebeat processing

Elastic Stack Beats
1

Dear all,

I need exclude archive files from filebeat processing.

My archive exstensions: *.gz, *.bz2

Currently i have configured exclusion of such type of files, but it is not working.

exclude_files: [".gz$",".out$",".bz2$"]

Quick response will be greatly appreciated.

1 Like
2

See here for an example: https://www.elastic.co/guide/en/beats/filebeat/5.3/configuration-filebeat-options.html#exclude-files You probably have the escape the dot.

1 Like
3

Is there any differences between ['.gz$','.bz2$'] and [".gz$",".bz2$"] ?

4

Yes, single and double quotes can matter.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.