I want to monitor /foo/log as well as /foo/bar/log and /foo/var/log. However, I am unable to using this our forwarder currently:
Inputs.conf:
[monitor:///foo/.../log]
The ...
is any number of directories
but what I think you need is *
which is any single directory
. In any case, either should work (but the former might lead to picking up unintended files/directories). Try the asterisk. Also, where did you place your inputs.conf file?
your command seems to be correct if the log filename to monitor is "log"!
I imagine that you already verified the connection between forwarder and indexer.
bye.
Giuseppe
Yes, I have checked inputstatus/TailingProcessor:FileStatus for the forwarder and it says whitelist doesn't match