topic Re: monitor blacklist Question in Getting Data In

monitor blacklist Question

rameshlpatel — Mon, 28 Sep 2020 15:38:20 GMT

Hi,

I have log file with name of erlDirService_log.log and erlDirService_error.log.

I want to put this in blacklist in monitor stanza(inputs.conf).

So How should I do this ?

Re: monitor blacklist Question

Ayn — Mon, 13 Jan 2014 08:26:24 GMT

What did you try that didn't work? What in the docs is unclear?

Re: monitor blacklist Question

rameshlpatel — Mon, 13 Jan 2014 08:32:43 GMT

I read the doc but its uncleared. I have to put this directly on production so i didnt try. I want to sure at first time.

Re: monitor blacklist Question

Ayn — Mon, 13 Jan 2014 09:09:08 GMT

[monitor:///your/path]
blacklist = erlDirService_log\.log|erlDirService_error\.log

Re: monitor blacklist Question

rameshlpatel — Mon, 13 Jan 2014 09:12:49 GMT

Can we make this in single like (Just example, dont know in splunk)

blacklist = erlDirService*.log

Re: monitor blacklist Question

Ayn — Mon, 13 Jan 2014 09:18:08 GMT

Yes and no - you can definitely do wildcarding, but it needs to be in regex syntax. Like erlDirService.*\.log. But if you're doing this in a production environment and don't really know what you're doing, I would suggest you to read up on how this works.