Exclude_files param not working

[yyovchev (Yovcho Yovchev)]

Hello, I try to exclude only one log file from filebeat, but the records are still sent to Elasticsearch. Here is my /etc/filebeat/modules.d/nginx.yml file:

# Module: nginx
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.4/filebeat-module-nginx.html

- module: nginx
  # Access logs
  access:
    enabled: true
    exclude_files: ["/var/log/nginx/exlude.this.domain.com_access.log"]
    var.paths: ["/var/log/nginx/*access*.log"]
    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

  # Error logs
  error:
    enabled: true
    var.paths: ["/var/log/nginx/*error*.log"]

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

Can you help me? Thank you for your time!
Best regards,

[TiagoQueiroz]

Hi @yyovchev ,

By default only var.paths is accepted as a configuration in the Nginx module.

However it is possible to override input settings as described here: Override input settings | Filebeat Reference [8.1] | Elastic

In your config you missed the input key, it should be:

- module: nginx
  # Access logs
  access:
    enabled: true
    var.paths: ["/var/log/nginx/*access*.log"]
    input:
        exclude_files: ["/var/log/nginx/exlude.this.domain.com_access.log"]