Hi,
I have an inputs.conf that is picking up a file that I want blacklisted. The file name is summary_1.diag. I thought this would filter it out. Any suggestions?
[monitor://F:\IBM\Lotus\Domino\Trace\*.diag]
sourcetype = STCommunityTraceLogs_diag
index = euc_sametimedata
disabled = false
followTail = 0
crcSalt = <SOURCE>
blacklist = summary_*.diag
I think that your problem lies in the blacklist
regex;
*
is a quantifier which means 'match the preceding character zero or more times', and . (dot) means 'match any character' (including a literal dot). So summary_*.diag
means summary
followed by zero or more underscores, followed by a single character, followed by diag
. This will match the following (and a lot of other strings);
summary.diag
summary_1diag
summary____Gdiag
However, it can not match summary_1.diag
. A regex that matches summary_
, followed by numbers, followed by .diag
would look like;
summary_\d+\.diag
/K