# Filebeat path glob support

**URL:** <https://discuss.elastic.co/t/filebeat-path-glob-support/185288>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 11, 2019, 10:37pm UTC](https://discuss.elastic.co/t/filebeat-path-glob-support/185288 "2019-06-11T22:37:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![SnakeByte](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@SnakeByte](https://discuss.elastic.co/u/SnakeByte)\
**Post date:** [June 11, 2019, 10:37pm UTC](https://discuss.elastic.co/t/filebeat-path-glob-support/185288/1 "2019-06-11T22:37:17Z")

</div>

According to the docs:  
[https://www.elastic.co/guide/en/logstash/6.7/glob-support.html](https://www.elastic.co/guide/en/logstash/6.7/glob-support.html)

It looks like there's some glob support for paths. However, a glob pattern I've written doesn't seem to be getting used by filebeat (the log file doesn't show harvesters for any of the existing files):

This is the pattern:  
+([0-9\_]).SecurityCheckAndDbAccess.log\*([.0-9])

It tests fine on globtester, so I thought I'd ask here in case I'm missing something obvious. Is glob support only partial?

---

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [June 11, 2019, 11:38pm UTC](https://discuss.elastic.co/t/filebeat-path-glob-support/185288/2 "2019-06-11T23:38:53Z")

</div>

Your glob doesn’t appear valid for filebeat, it also doesn’t appear to be valid for logstash.

For filebeat the important info is here:  
[https://golang.org/pkg/path/filepath/#Match](https://golang.org/pkg/path/filepath/#Match)

For logstash I’m unsure what the authority is but the doc you reference doesn’t document the pattern you described as valid either.

---

<div class="post-metadata">

**Author:** ![SnakeByte](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@SnakeByte](https://discuss.elastic.co/u/SnakeByte)\
**Post date:** [June 12, 2019, 1:19am UTC](https://discuss.elastic.co/t/filebeat-path-glob-support/185288/3 "2019-06-12T01:19:52Z")

</div>

Ah, looks like the parenthesis stuff I was using is "extended" glob:  
[https://www.gnu.org/software/bash/manual/html\_node/Pattern-Matching.html](https://www.gnu.org/software/bash/manual/html_node/Pattern-Matching.html)

I'll use exclude\_files to work around this.

---

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [June 12, 2019, 2:24am UTC](https://discuss.elastic.co/t/filebeat-path-glob-support/185288/4 "2019-06-12T02:24:35Z")

</div>

hehe, you’re in for a treat, that doesn’t exists 😉  
It’s for lines, not files.

Maybe there is another way, with only globs. I don’t how your files are named and managed.

---

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [June 12, 2019, 2:25am UTC](https://discuss.elastic.co/t/filebeat-path-glob-support/185288/5 "2019-06-12T02:25:42Z")

</div>

lol MY bad.. it does, I had never looked at it before 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2019, 2:25am UTC](https://discuss.elastic.co/t/filebeat-path-glob-support/185288/6 "2019-07-10T02:25:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.