topic Re: Why is a specific file type still being indexed with my inputs.conf whitelist configuration? in Getting Data In

Why is a specific file type still being indexed with my inputs.conf whitelist configuration?

mlaufenb — Wed, 02 Sep 2015 16:52:01 GMT

Here's my stanza:

[monitor:///opt/stash/logs/]
blacklist = \.gz$
disabled = false
followTail = 0
index = stash_pp
sourcetype = log4j
whitelist = (*access\.log$|*stash\.log$|*mail\.log$|*profiler\.log$|*debug\.log$|*plugin\.log$|*codesearch\.log$|\.out$)

I'm getting this file type atlassian-stash-access-2015-08-31.0.log which should have been excluded with the whitelist specification. Is there something wrong with the syntax?

Any help would be appreciated!

Re: Why is a specific file type still being indexed with my inputs.conf whitelist configuration?

lguinn2 — Wed, 02 Sep 2015 19:10:08 GMT

The proper regular expression for the whitelist is

whitelist = (.*access\.log$|.*stash\.log$|.*mail\.log$|.*profiler\.log$|.*debug\.log$|.*plugin\.log$|.*codesearch\.log$|\.out$)

The * alone just means "match an asterisk" in regular expressions. While Splunk does sometime allow a mix of globbing and regular expressions, don't do it here...