# Exclude\_files regex

**URL:** <https://discuss.elastic.co/t/exclude-files-regex/63692>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 23, 2016, 9:18pm UTC](https://discuss.elastic.co/t/exclude-files-regex/63692 "2016-10-23T21:18:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Winfield\_Henry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/winfield_henry/32/69344_2.png) [@Winfield\_Henry](https://discuss.elastic.co/u/Winfield_Henry)\
**Post date:** [October 23, 2016, 9:18pm UTC](https://discuss.elastic.co/t/exclude-files-regex/63692/1 "2016-10-23T21:18:41Z")

</div>

Hello,

We have some duplicated log entries and would like to exclude a particular log file. There is an 'exclude\_files:' directive in the .yml config file, but we are having difficulty making that work.

Question: Is this directive working?  
To exclude a file named: badfile.log what would a proper regex be?  
How long after restarting filebeat would you expect the file to NOT appear in Kibana/Elasticsearch?

We have tried (with stopping/starting filebeat between each iteration):  
exclude\_files:"badfile.log"  
exclude\_files:["badfile.log"]  
exclude\_files:["^badfile.log$"]  
exclude\_files:["^//var//log//badfile.log$"]  
and a few others.

Thanks,  
W

---

<div class="post-metadata">

**Author:** ![Houss](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@Houss](https://discuss.elastic.co/u/Houss)\
**Post date:** [October 24, 2016, 4:10am UTC](https://discuss.elastic.co/t/exclude-files-regex/63692/2 "2016-10-24T04:10:10Z")

</div>

Hi,

exclude\_files: ['badfile\.log$'] should work.

Template is exclude\_files: ['regex']  
$ says that the end of the file name is badfile.log  
You have to escape the . with \ in a regex, otherwise, . just means "any character"

Cheers.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 24, 2016, 7:54am UTC](https://discuss.elastic.co/t/exclude-files-regex/63692/3 "2016-10-24T07:54:50Z")

</div>

Can you share your full filebeat config?

---

<div class="post-metadata">

**Author:** ![Winfield\_Henry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/winfield_henry/32/69344_2.png) [@Winfield\_Henry](https://discuss.elastic.co/u/Winfield_Henry)\
**Post date:** [October 24, 2016, 12:07pm UTC](https://discuss.elastic.co/t/exclude-files-regex/63692/4 "2016-10-24T12:07:44Z")

</div>

Hi,

exclude\_files: ["badfile\.log$"]

filebeat will not start with the above.

* * *

filebeat:  
prospectors:  
-  
paths:  
- /var/log/messages  
- /var/log/syslog  
- /var/log/\*.log

```
  input_type: log

```

exclude\_files: ["badfile\.log$"]

output:  
logstash:  
hosts: ["localhost:5044"]  
worker: 1  
index: filebeat  
shipper:

logging:

files:

* * *

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2016, 9:19pm UTC](https://discuss.elastic.co/t/exclude-files-regex/63692/5 "2016-11-13T21:19:05Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.