Filebeat CEL Input Type - FIle Options

I'm using a CEL type input in Filebeat. Currently the filebeat.yml file points at a specific directory/file.

What is the syntax to wildcard a portion of the file? (i.e. for the parameter
resource.url: file:///home/directory/subdirectory1/subdirectory2/

how can I specify
resource.url: file:///home/directory/*/subdirectory2/

in the filebeat.yml file?

Marty Pacocha


you can use wildcards in the paths to specify multiple files. However, the wildcard (*) can only be used to match files in a directory, not directories themselves.

if you want to match files in multiple directories, you will need to specify each directory separately. For example:

- type: log
  enabled: true
    - /home/directory/subdirectory1/subdirectory/*.log
    - /home/directory/subdirectory3/subdirectory/*.log


We are successfully using wildcards in directories in other Filebeat inputs. The difference between those instances and this one is that for the successful instance we use the keyword paths, but for CEL we need to use the keyword resource.

I'm trying to figure out is whether we can use wildcards for the resource keyword or not.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.