Filebeat exclude_files is not working as expected for windows

Elastic Filebeat 8.7.0
file path "d:\log\LuceneSOA\排序搜索结果\2023-06-21.txt", Exclude txt files dated under the file but not working
the regexp was verified with regex101.com

filebeat.yml input

filebeat.inputs:    
- type: filestream 
  paths:
    - d:\log\*.txt
    - d:\log\*\*.txt
    - d:\log\*\*\*.txt
  tail_lines: true
  tags: ["app", "hb"]
  exclude_lines: ["^-"]
  exclude_files: 
    - '\w+\:\\\\\w+\\\\\w+\\\\排序搜索结果\\.*txt'
    - 'd:\log\LuceneSOA\排序搜索结果\*.txt'
    - '^d:\log\LuceneSOA'
    - '^d:\\log\\LuceneSOA'
    - '.*排序搜索结果.*'
    - '.*[\u6392][\u5e8f][\u641c][\u7d22][\u7ed3][\u679c]/.*txt'
    - '.*排序搜索结果.*.txt$'
    - '.*[\u6392][\u5e8f][\u641c][\u7d22][\u7ed3][\u679c].*.txt$'
    - '^\w+\:\\\w+\\\w+\\排序搜索结果\\\d{4}\-\d{2}\-\d{2}\.\w+'
    - '\w+\:\\\w+\\LuceneSOA'
    - '\w+\:\\\w+\\LuceneSOA\\.*'
    - '\w+\:\\\\\w+\\\\LuceneSOA\\.*'
    - '\w+\:\\\\\w+\\\\\w+\\\\[\u6392][\u5e8f][\u641c][\u7d22][\u7ed3][\u679c]'
    - '\w+\:\\\\\w+\\\\\w+\\\\[\u6392][\u5e8f][\u641c][\u7d22][\u7ed3][\u679c]\\\\.*txt'
    - '\w+\:\\\w+\\\w+\\[\u6392][\u5e8f][\u641c][\u7d22][\u7ed3][\u679c]\\.*txt'
    
  encoding: utf8
  ignore_older: 2h
  fields_under_root: true
  multiline.type: pattern
  multiline.pattern: '^\[\d{4}-\d{1,2}-\d{1,2}|^\d{4}/\d{1,2}/\d{1,2}|^\d{4}-\d{1,2}-\d{1,2}'
  multiline.negate: true
  multiline.match: after

Any help would be much appreciated.
Thanks,

Welcome to the community junly.
Maybe this is an issue: ignore_older: 2h - do not read files older than 2h

Also simplify, just for test purpose.
multiline.pattern: '^\[\d{4}-*'
Latter, you can add more from the line your full pattern.

I think you have too many exlude_files. Paths are only d:\log\*, don't see any point of \w+\:\\\w+\\LuceneSOA'

When things are not working in the current logic, make the simplest yml then go step by step, make more and more complex.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.