Recursive file paths

Elastic Stack Beats
1

Hi,

I was experimenting with Auditbeat file monitoring. What I wanted is to monitor all files in the "C:\Program Files" folder of a Windows VM. However, when altering files (add, remove, etc.) in some of the subdirectories I only receive update messages from the folder in which those files exist.

On the documentation it also said it does watch non-recursive. However, I (and I think that there are many people with me) would really like to monitor all files in all sub directories.

Is there a possibility that this will be done in the near future?
One could for example define file.paths.include and file.paths.exclude to ensure certain subdirectories will be excluded.

Thanks!

2

It's definitely possible. The level effort to add it for Windows is low (b/c the OS supports it), but we like to keep feature parity across operating systems so we also need to implement it on macOS and Linux. I think implementing it on macOS and Linux will take more effort because the underlying OS APIs don't natively support recursive monitoring and we need to implement it in userspace

Please open an enhancement request on Github for this. We don't yet have an issue for it (but I have heard a few other requests for this).