Filebeat exclude_files regex

Elastic Stack Beats
1

I want to exclude all access logs files from the filebeat except 2 service access logs. I'm using the regex but getting error and filebeat start is failing

exclude_files: ['\/var\/log\/xxx\/.*(?!.*(xxx)).*\/.*(?!.*(xxx)).*-access.log']

error message

`ERROR        instance/beat.go:989        Exiting: Failed to start crawler: starting input failed: Error while initializing input: error parsing regexp: invalid or unsupported Perl syntax: `(?!` accessing 'filebeat.inputs.0.exclude_files.0' (source:'/etc/filebeat/filebeat.yml')
filebeat[8457]: Exiting: Failed to start crawler: starting input failed: Error while initializing input: error parsing regexp: invalid or unsupported Perl syntax: `(?!` accessing 'filebeat.inputs.0.exclude_files.0' (source:'/etc/filebeat/filebeat.yml')`
2

Hi Shubham,

The error states the pattern '(?!' is not supported. I'm assuming you're using ! as not in this case. Have you tried using the negated operator ^, as per the regex support guide?

3

Tried negated operator but whole words do not work inside of a character class.

example- I don't want to match message-portal in the string but message-list should be matched in this case negate operator is failing.

4

The issue still persists any work around for the same can be done

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.