# How to setup logstash-forwarder to read recursively on a path?

**URL:** <https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814>\
**Category:** Logstash\
**Created:** [September 22, 2015, 9:51pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814 "2015-09-22T21:51:18Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![chaudharikiranp](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@chaudharikiranp](https://discuss.elastic.co/u/chaudharikiranp)\
**Post date:** [September 22, 2015, 9:51pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814/1 "2015-09-22T21:51:18Z")

</div>

Please helo me understand how to setup logstash-forwarder to read recursively on a path.

For example if the file I want logstash forwarder is build.xml and it can be anywhere in the directory structure "/foo/bar/jobs/\*\*/builds/\*/build.xml where the 'foo', 'bar' and 'jobs' and 'builds' are the fixed directories names.  
The valid paths can be foo/bar/jobs/xyz/abc/builds/11/build.xml , foo/bar/jobs/xyz/abc/def/ghe/builds/12/build.xml , foo/bar/jobs/lmn/opq/jbz/abc/builds/91/build.xml

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 23, 2015, 2:27am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814/2 "2015-09-23T02:27:20Z")

</div>

You can use wildcards there, are you having problems if you use them?

---

<div class="post-metadata">

**Author:** ![chaudharikiranp](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@chaudharikiranp](https://discuss.elastic.co/u/chaudharikiranp)\
**Post date:** [September 23, 2015, 7:23am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814/3 "2015-09-23T07:23:25Z")

</div>

Yes I tried using multiple combinations but nothing is working. For example I use the below pattern but it doesn't work. /foo/bar/jobs/\*\*/builds/\*/build.xml. Here \*\* and \* can be any number of subdirectories in the path till build.xml file from Jenkins.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 23, 2015, 9:20pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814/4 "2015-09-23T21:20:30Z")

</div>

Well each \* is considered a single directory, not one or more. If there are multiple directories there you need to add more `*/` entries.

---

<div class="post-metadata">

**Author:** ![chaudharikiranp](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@chaudharikiranp](https://discuss.elastic.co/u/chaudharikiranp)\
**Post date:** [September 24, 2015, 7:05pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814/5 "2015-09-24T19:05:14Z")

</div>

Thank you for the reply.  
Actually the number of subdirectories can differ from build to build. Sometime the it could be at 2 level deep, sometime at 5 levels deeps, etc.

I believe this is a limitation of logstash forwarder that it cannot monitor the subfolders recursively for logs files creations.

Can anybody please cofirm or is there a way?

---

<div class="post-metadata">

**Author:** ![chaudharikiranp](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@chaudharikiranp](https://discuss.elastic.co/u/chaudharikiranp)\
**Post date:** [September 25, 2015, 4:59pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814/6 "2015-09-25T16:59:52Z")

</div>

Is there anyone knows how to setup logstash-forwarder to read recursively on a path? This is show-stopper for using ELK.

---

<div class="post-metadata">

**Author:** ![chaudharikiranp](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@chaudharikiranp](https://discuss.elastic.co/u/chaudharikiranp)\
**Post date:** [November 10, 2015, 4:25pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814/7 "2015-11-10T16:25:27Z")

</div>

Is this limitation of recursive read on a path for log files is resolved with Logstash 2.0?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-forwarder-to-read-recursively-on-a-path/29814/8 "2017-07-06T05:23:15Z")

</div>


