I am using filebeat version 7.3.1. There is an issue with the below sample filebeat configuration. I need to skip all the folders named "ignore" as mentioned in paths. I used the exclude_files pattern, But those logs are processing by filebeat and pushing to elasticsearch. please correct the patterns or help to find out the issue , how to skip the folders named "ignore" in below context.
filebeat.inputs: - type: log enabled: true paths: - "/apps/logs/mount1/*/*.log" - "/apps/logs/mount2/*/*.log" - "/apps/logs/mountn/*/*.log" exclude_files: ['^/apps/logs/*/ignore/*.log$'] fields_under_root: true ignore_older: 1h close_inactive: 20s close_removed: true close_renamed: true clean_removed: true clean_renamed: true scan_frequency: 10s
Thanks in advance