I have used the below configuration as part of my inputs.conf but am unable to blacklist the logs that end with client.log and server.log using this. For now I had to explicitly add "blacklist = .server.log$" to blacklist them. Any changes needed to fix and get this working here ?
1) I'm seeing spaces between the |
and the terms beside it. That would cause issues.
2) Remember that a .
matches anything, so it you mean only the character.
, then you need to escape it like this - \.
.
3) Parenthesis are not necessary in this context, when you are providing alternates for the entire pattern. They are useful if you want to give alternatives for a small part of a pattern.
4) If the file names may be case sensitive, then (i) at the front of the pattern can make the regular expression case-insensitive.
So, if the individual blacklist lines worked and were not case sensitive, then either of these should work...
\.client\.log$|\.server\.log$
...or ...
\.(client|server)\.log$
1) I'm seeing spaces between the |
and the terms beside it. That would cause issues.
2) Remember that a .
matches anything, so it you mean only the character.
, then you need to escape it like this - \.
.
3) Parenthesis are not necessary in this context, when you are providing alternates for the entire pattern. They are useful if you want to give alternatives for a small part of a pattern.
4) If the file names may be case sensitive, then (i) at the front of the pattern can make the regular expression case-insensitive.
So, if the individual blacklist lines worked and were not case sensitive, then either of these should work...
\.client\.log$|\.server\.log$
...or ...
\.(client|server)\.log$