Regex not worked with filebeat

Elastic Stack Beats
1

Hi Dear,
I'm trying to exclude any files starting with gc but below regex did not work
and regex is verified, myfilebeat version is :8.3.2

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

# filestream is an input for collecting log messages from files.
- type: filestream

  # Unique ID among all inputs, an ID is required.
  id: my-filestream-id

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    #- c:\programdata\elasticsearch\logs\*
    - /app/softwareag/wm1011/IntegrationServer/instances/default/*

  ignore_older: 24h
  close_inactive: 5m
  clean_inactive: 30h

  prospector.scanner.exclude_files: ['.gz$', '^gc.*']
2

I believe exclude files is not applied to the filename but instead to the path so I think you would need a regex that matches /app/softwareag/wm1011/IntegrationServer/instances/default/gc......... which yours won't because of the start of line anchor ^

3

thanks worked after changed to full path

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.