Filebeat mssql module multiple drive paths in var.paths config

I am ingesting mssql logs from a failover cluster. Due to the nature of the cluster each node has a different mount / drive letter for the log data. The cluster may have M:, N:, O: P:, etc. but only one per node. This make it difficult to do a standard deploy of the mssql module as I have to list each drive in the config (see below), to make sure that each drive is covered. If a node were to failover, there may be two drives (M: and N:) on a single node. Listing each possible drive is very messy.

Is there a way to list a range of drives such as below or am I going to have to continue with the multiple drive listing?

- [M-Q]:\Log\ERRORLOG*
- [M-Q]:\Log\SQLAGENT*

Current config below

# Module: mssql
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.13/filebeat-module-mssql.html
 
- module: mssql
  # Fileset for native deployment
  log:
    enabled: true
    var.paths:
      - M:\Log\ERRORLOG*
      - M:\Log\SQLAGENT*
      - N:\Log\ERRORLOG*
      - N:\Log\SQLAGENT*
      - O:\Log\ERRORLOG*
      - O:\Log\SQLAGENT*
      - P:\Log\ERRORLOG*
      - P:\Log\SQLAGENT*
      - Q:\Log\ERRORLOG*
      - Q:\Log\SQLAGENT*
    input:
      encoding: utf-16le-bom
      pipeline: logs-mssql

According to the documentation, should be supported.
I hadn't try, however syntax should be like your suggested or something like this:
- [m-qM-Q]:\Log\SQLAGENT*

Glob returns the names of all files matching pattern or nil if there is no matching file. The syntax of patterns is the same as in Match.

Match reports whether name matches the shell file name pattern. The pattern syntax is:

pattern:
{ term }
term:
'' matches any sequence of non-Separator characters
'?' matches any single non-Separator character
'[' [ '^' ] { character-range } ']'
character class (must be non-empty)
c matches character c (c != '
', '?', '\', '[')
'\' c matches character c

character-range:
c matches character c (c != '\', '-', ']')
'\' c matches character c
lo '-' hi matches character c for lo <= c <= hi

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.