Excluded_files doesn't seem to work

Elastic Stack Beats
1

I used the default excluded_files example:

    excluded_files:
      - '(?i)\.sw[nopx]$'
      - ~$
      - /\.git($|/)

but it still logs temporary files created by vim like .<filename>.swp or ~<filename>.

I also tried this:

    excluded_files:
      - '(?i).*\.sw[nopx]$'

but it also doesn't work. I'm using auditbeat-7.13.4-1.x86_64.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.