Filebeat Configuration On excluding files

[Miguel_Leite]

Hello guys!

I've been trying to fetch some logs from a specific directory, with enumerous logs files... So I tried the following config:

- type: log
  enabled: true
  paths:
    - /base/log/*.log
  tags: ["root_log"]

Then I exclude some files that I want to parse and treat in a different way, so I did:

exclude_files: ['base/log/proc_check\.log']
exclude_files: ['base/log/Debug_Logging\.log']

But the problem is that this logs itself are being treated in that specific fetch, as I can see the root_log tag attached to the events...
Am I doing anything wrong?

[pierhugues (Pier-Hugues Pellerin)]

Hello @Miguel_Leite,

I think there might be a problem with the way you are defining the exclude_files patterns, the option can take multiple regexp or a regexp can match multiple files.

I think making the following changes would work for you:

- type: log
  enabled: true
  paths:
    - /base/log/*.log
  tags: ["root_log"]
  exclude_files: ['(proc_check|Debug_Logging).log$']

Also, you can start Filebeat in debug mode and see a bit more what is going on.

filebeat -v -e -d "*"