Wildcard for 2 character in logstash input path

Elastic Stack Logstash
1

Hello,

My problem is very simple...

In my input file i have this :

input {
  file {
    path => "/data/logstash/celisible_elkf/DCfw*7_*.txt"
    exclude => "DCfw*6_*.txt"
    type => "cra"
    max_open_files => 30000
  }
}

Problem sometimes wrong files are upload...

I wanted just replace 2 character like this :

input {
  file {
    path => "/data/logstash/celisible_elkf/DCfw??7_*.txt"
    type => "cra"
    max_open_files => 30000
  }
}

But it's seems not work

2

That should work. Can you run

ls /data/logstash/TM/data/opm1za*/cra/celisible_elkf/DCfw??7_*.txt

as the Logstash user and get the expected results?

3

I try this :

(Logstash user is configured to nologin account )

su - logstash -s /bin/bash -c "ls -ltr /data/logstash/celisible_elkf/DCfw??7_*.txt"

It's working.

Logstash understand shell language ? I thought no.

So if i understand, this line is correctly understood and executable by logstash ? :

path => "/data/logstash/celisible_elkf/DCfw*[78]_*_*.txt"

4

I don't think Logstash supports all shell wildcard characters but I'd be surprised if ? didn't work, but I don't think I've used anything but * myself.

5

Yes i go test I keep you informed

It's ok my path line look like :

/data/logstash/celisible_elkf/DCfw??[78]_*_*.txt

It's works fine.

Thank you for all @magnusbaeck

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.