I am ingesting mssql logs from a failover cluster. Due to the nature of the cluster each node has a different mount / drive letter for the log data. The cluster may have M:, N:, O: P:, etc. but only one per node. This make it difficult to do a standard deploy of the mssql module as I have to list each drive in the config (see below), to make sure that each drive is covered. If a node were to failover, there may be two drives (M: and N:) on a single node. Listing each possible drive is very messy.
Is there a way to list a range of drives such as below or am I going to have to continue with the multiple drive listing?
- [M-Q]:\Log\ERRORLOG*
- [M-Q]:\Log\SQLAGENT*
Current config below
# Module: mssql
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.13/filebeat-module-mssql.html
- module: mssql
# Fileset for native deployment
log:
enabled: true
var.paths:
- M:\Log\ERRORLOG*
- M:\Log\SQLAGENT*
- N:\Log\ERRORLOG*
- N:\Log\SQLAGENT*
- O:\Log\ERRORLOG*
- O:\Log\SQLAGENT*
- P:\Log\ERRORLOG*
- P:\Log\SQLAGENT*
- Q:\Log\ERRORLOG*
- Q:\Log\SQLAGENT*
input:
encoding: utf-16le-bom
pipeline: logs-mssql