# Excluding Access Files

**URL:** <https://discuss.elastic.co/t/excluding-access-files/140358>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 17, 2018, 3:17pm UTC](https://discuss.elastic.co/t/excluding-access-files/140358 "2018-07-17T15:17:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\
**Post date:** [July 17, 2018, 3:17pm UTC](https://discuss.elastic.co/t/excluding-access-files/140358/1 "2018-07-17T15:17:31Z")

</div>

version 6.3 for the entire ELK Stack

hello! i am trying to exclude all access files from filebeat but am having trouble with the syntax.

i am allowing all of the files because i have multiple folders with the same structure and different names: `- /opt/*/tomcat/logs/*`  
but am also trying to exclude the access files: `- /opt/*/tomcat/logs/access*`

Please view my filebeats.yml file below:

```
filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
#- /var/log/*.log
#- /var/log/secure
#- /var/log/messages
- /opt/*/tomcat/logs/*
- /usr/share/apache-tomcat-8.0.28/logs/catalina.*
#- c:\programdata\elasticsearch\logs\*

  exclude_files:
- /opt/*/tomcat/logs/access*

```

It is possible that my path overrides my exclude... what would be the correct way to exclude a file within the folder i have included all (\*)?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 17, 2018, 9:33pm UTC](https://discuss.elastic.co/t/excluding-access-files/140358/2 "2018-07-17T21:33:03Z")

</div>

I think your issue is that `exclude_files` expects regular expressions, not file globs, so what you want is:

```auto
exclude_files:
  - /opt/.*/tomcat/logs/access

```

or just

```auto
exclude_files:
  - /tomcat/logs/access

```

---

<div class="post-metadata">

**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\
**Post date:** [July 18, 2018, 2:52pm UTC](https://discuss.elastic.co/t/excluding-access-files/140358/3 "2018-07-18T14:52:48Z")

</div>

Hi @adrisr,

thanks for your reply, i wanted to confirm that you do not need the `*` symbol after "access" like this:

```
exclude_files:
  - /tomcat/logs/access*
```

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 18, 2018, 3:19pm UTC](https://discuss.elastic.co/t/excluding-access-files/140358/4 "2018-07-18T15:19:51Z")

</div>

No, it's not needed.

If you add it, it will have a meaning different to what you expect.

Have a look at our documentation to learn more about regular expressions:  
[https://www.elastic.co/guide/en/beats/filebeat/current/regexp-support.html](https://www.elastic.co/guide/en/beats/filebeat/current/regexp-support.html)

---

<div class="post-metadata">

**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\
**Post date:** [July 18, 2018, 6:21pm UTC](https://discuss.elastic.co/t/excluding-access-files/140358/5 "2018-07-18T18:21:09Z")

</div>

I'll start adding this to all of my servers now!

Thanks again @adrisr!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2018, 6:21pm UTC](https://discuss.elastic.co/t/excluding-access-files/140358/6 "2018-08-15T18:21:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.