Hi Experts
I have following monitor stanza . I want to blacklist "data/xyz/logs/router.jar.log" but want to monitor "/data/xyz/logs/abc/abc-router/abc-router.jar.log" . Though I have mentioned router.* still is blacklisting "abc-router.jar.log". Please help here
[monitor:///data/xyz/logs/]
index = test
sourcetype = test_st
whitelist=\.jar\.log$
blacklist=discovery.*|router.*|java.*
disabled = 0
Hi vaibhavagg2006,
maybe you alredy tested this solution:
[monitor:///data/xyz/logs/]
index = test
sourcetype = test_st
whitelist=\.jar\.log$
blacklist=(discovery|router|java)\/abc-router\.jar\.log
disabled = 0
Bye.
Giuseppe
Thanks for your inputs
I do not want to blacklist /logs/abc/abc-router.jar.log
Only want to blacklist /logs/router.jar.log
try
[monitor:///data/xyz/]
index = test
sourcetype = test_st
whitelist=logs\/\.jar\.log$
blacklist=(discovery|router|java)\/abc-router\.jar\.log
disabled = 0
Bye.
Giuseppe
may i know, if the monitor path was correct in the question?!?!
[monitor:///data/xyz/logs/abc/abc-router/]
index = test
sourcetype = test_st
whitelist=.jar.log$
blacklist=discovery\.|router\.|java\.*
disabled = 0
Monitor path is "///data/xyz/logs/"
There are multiple dynamic folders under logs
abc
qwe
poi
Also there is a file "router.jar.log" inside logs folder. I want to black list it. But want to index a file "abc-router.jar.log" present in /logs/abc/
whitelist=\.jar\.log$
blacklist=discovery\.|router\.|java\.*