topic Configure input.conf in Getting Data In

Configure input.conf

moohkhol — Mon, 28 Sep 2020 15:56:36 GMT

All,

I want to monitor Apache log and file name is appended with date, so it's dynamic file. eg,

Log directory:
/var/apache/logs/
File name is,
apache_log.2014.02.20
apache_log.2014.02.19
apache_log.2014.02.18
apache_log.2014.02.17.gz
apache_log.2014.02.16.gz

Running log is coming into apache_log.2014.02.20 and I also want to ignore all the files with *.gz name, since old files are getting archived and present into same directory (/var/apache/logs/).
Please some one can give details about stanza of input.conf and other details if required.

Re: Configure input.conf

kristian_kolb — Thu, 20 Feb 2014 07:51:40 GMT

Name your index and sourcetype - the latter likely to access_combined, or access_common

[monitor:///var/apache/log/apache_log*]
index = your_index
sourcetype = your_sourcetype
blacklist = \.gz

Re: Configure input.conf

moohkhol — Mon, 28 Sep 2020 15:56:38 GMT

Thankx Kristain,
"/var/apache/log/" also contains different logs such as Mod_jk, error, ssl logs, so i want to specify something like that, Monitor should able to read file only with name of apache_log... and i can also able to specify it should not read before some date, lets say if I am configuring today than it should start from today should not read apache_log.2014.02.19 apache_log.2014.02.18 file.

Re: Configure input.conf

Ayn — Thu, 20 Feb 2014 08:03:55 GMT

Note that the file is called "inputs.conf", not input.conf.

Re: Configure input.conf

moohkhol — Thu, 20 Feb 2014 08:25:30 GMT

Yes, Thankx

Re: Configure input.conf

kristian_kolb — Thu, 20 Feb 2014 08:46:29 GMT

you can add some more information to the monitor path (like above), or define a whitelist as well, which should amount to the same thing. See;

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Specifyinputpathswithwildcards#Wildcards_and_whitelisting