# Exclude Directorys in Filebeat

**URL:** <https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 11, 2020, 1:08pm UTC](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139 "2020-03-11T13:08:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neropointer](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Neropointer](https://discuss.elastic.co/u/Neropointer)\
**Post date:** [March 11, 2020, 1:08pm UTC](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139/1 "2020-03-11T13:08:50Z")

</div>

I need harvest all log files in an directory and the subdirectories and exclude the backup directories that are in the same location.  
e. g.  
/foo/bar/service1/_.log  
/foo/bar/service1.backup/_.log  
/foo/bar/service2/_.log  
/foo/bar/service2.backup/_.log

is there a possibility to exclude all the directories with the ending .backup and their subdirectories from harvesting.

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 11, 2020, 3:03pm UTC](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139/2 "2020-03-11T15:03:36Z")

</div>

I think you may find an answer in this thread: [How to exclude a sub directory and all of it's files](https://discuss.elastic.co/t/how-to-exclude-a-sub-directory-and-all-of-its-files/137317)

---

<div class="post-metadata">

**Author:** ![Neropointer](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Neropointer](https://discuss.elastic.co/u/Neropointer)\
**Post date:** [March 11, 2020, 3:06pm UTC](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139/3 "2020-03-11T15:06:28Z")

</div>

I tried this as

```auto
 exclude_files:
    - '^/foo/bar/*.backup/'

```

without any success

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 11, 2020, 3:22pm UTC](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139/4 "2020-03-11T15:22:30Z")

</div>

I'm afraid this is not a valid regular expression. Please try to use sth like this:

```
 '^\/foo\/bar\/.+(.backup)\/.+'

```

also - you can use this page to figure out a proper regular expression: [https://regex101.com/](https://regex101.com/)

---

<div class="post-metadata">

**Author:** ![Neropointer](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Neropointer](https://discuss.elastic.co/u/Neropointer)\
**Post date:** [March 12, 2020, 10:05am UTC](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139/5 "2020-03-12T10:05:42Z")

</div>

Thank you, that worked. And the link will come in handy.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2020, 10:05am UTC](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139/6 "2020-04-09T10:05:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.