# Using wildcard character in logstash input

**URL:** <https://discuss.elastic.co/t/using-wildcard-character-in-logstash-input/88585>\
**Category:** Logstash\
**Created:** [June 7, 2017, 12:50pm UTC](https://discuss.elastic.co/t/using-wildcard-character-in-logstash-input/88585 "2017-06-07T12:50:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jigarpatel13533](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jigarpatel13533/32/18675_2.png) [@jigarpatel13533](https://discuss.elastic.co/u/jigarpatel13533)\
**Post date:** [June 7, 2017, 12:50pm UTC](https://discuss.elastic.co/t/using-wildcard-character-in-logstash-input/88585/1 "2017-06-07T12:50:28Z")

</div>

Hi,

I am using logstash 2.1 in **Windows Server 2008 R2** OS. (Version Corrected)  
I have some log files at some another server, and I am taking them as input for my logstash.

Shared Path : **\\MIB030065\share2\Statoil-logs\Sharepoint/ST-W2284-20170607-0841.log**

Now if I writing below in config file, it's discovering the changes (happening real time) in the same file.  
input{  
file{  
type =\> "logs"  
_path =\> ["\\MIB030065\share2\Statoil-logs\Sharepoint/ST-W2284-20170607.log"]_\*  
codec =\> multiline {  
negate =\> true  
pattern =\> "(^%{DATESTAMP})"  
what =\> "previous"  
charset =\> "UTF-8"  
}  
}  
}

When I writing below, logstash is not able to discover that file or may be changes in that file.  
input{  
file{  
type =\> "logs"  
_path =\> ["\\MIB030065\share2\Statoil-logs\Sharepoint/ST-W2284.log"]_\*  
codec =\> multiline {  
negate =\> true  
pattern =\> "(^%{DATESTAMP})"  
what =\> "previous"  
charset =\> "UTF-8"  
}  
}  
}

even below are not working.  
**path =\> ["\\MIB030065\share2\Statoil-logs\Sharepoint/\*.log"]**  
**path =\> ["\\MIB030065\share2\Statoil-logs\Sharepoint/_._"]**  
**path =\> ["\\MIB030065\share2\Statoil-logs\Sharepoint/\*"]**

If anyone can help or come up with a workaround, I'd appreciate it.

Thanks,  
Jigar Jarsania

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 9, 2017, 7:37am UTC](https://discuss.elastic.co/t/using-wildcard-character-in-logstash-input/88585/2 "2017-06-09T07:37:44Z")

</div>

I'd try using forward slashes instead of backslashes. I'd also be consistent about using the same kind of slashes everywhere in the filename pattern. Apart from that I don't know what's up.

---

<div class="post-metadata">

**Author:** ![jigarpatel13533](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jigarpatel13533/32/18675_2.png) [@jigarpatel13533](https://discuss.elastic.co/u/jigarpatel13533)\
**Post date:** [June 12, 2017, 7:48am UTC](https://discuss.elastic.co/t/using-wildcard-character-in-logstash-input/88585/3 "2017-06-12T07:48:52Z")

</div>

If I'd use forward slashes too, then also it's not working. That's why I want to generate file name dynamically.  
Is there any way to get sysdate there and I can make file name using the sysdate dynamically.?

like,  
//MIB030065/share2/Statoil-logs/Sharepoint/ST-W2284-\*.log

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 12, 2017, 7:58am UTC](https://discuss.elastic.co/t/using-wildcard-character-in-logstash-input/88585/4 "2017-06-12T07:58:10Z")

</div>

Do you expect new files to be read from the beginning or just tailed for new input? In the former case, make sure you have `start_position => "beginning"` in your file input.

To debug this further, let's establish whether the problem really is the file globbing. Bump up the log level and look for "discover" or "glob" in the Logstash log file. There should be a line logged every few seconds that indicates what the filename pattern expands to.

---

<div class="post-metadata">

**Author:** ![jigarpatel13533](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jigarpatel13533/32/18675_2.png) [@jigarpatel13533](https://discuss.elastic.co/u/jigarpatel13533)\
**Post date:** [June 14, 2017, 6:34am UTC](https://discuss.elastic.co/t/using-wildcard-character-in-logstash-input/88585/5 "2017-06-14T06:34:33Z")

</div>

Hi Magnus,

Sorry for wrong info. It was a typo by me. The OS is **Windows Server 2008 R2**.

Logstash 5.0 (or 2.4 or 2.1) is not working properly with the remote logs from Windows Server 2008 OS  
through logstash WINDOWS Service only.

I'm facing above wildcard issue too in the same setup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2017, 6:34am UTC](https://discuss.elastic.co/t/using-wildcard-character-in-logstash-input/88585/6 "2017-07-12T06:34:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.