topic Re: How to blacklist a single source path on a universal forwarder? in Getting Data In

How to blacklist a single source path on a universal forwarder?

prakash007 — Thu, 02 Jun 2016 21:55:30 GMT

I have the monitor stanza on one of my Universal Forwarders.....I tried to blacklist a particular JVM from which the logs are not required to be monitored. Any help would be appreciated on this.

inputs.conf

    [monitor:///opt/server/webservers/*/logs/access*.log]
    sourcetype=access_logs
    blacklist=\/opt\/server\/webservers\/JVM_DEV\/logs\/access*\.log
    crcSalt = <SOURCE>
    index=devint2

Re: How to blacklist a single source path on a universal forwarder?

woodcock — Fri, 03 Jun 2016 04:12:24 GMT

Like this:

    blacklist=\/opt\/server\/webservers\/JVM_DEV\/logs\/access[^\.]*\.log

Re: How to blacklist a single source path on a universal forwarder?

prakash007 — Fri, 03 Jun 2016 15:31:47 GMT

some how this worked for me as my logs might be in 2 different formats

/opt/server/webservers/JVM_DEV/logs/access.20160203000000.log
/opt/server/webservers/JVM_DEV/logs/access20160203000000.log

blacklist=\/opt\/server\/webservers\/JVM_DEV\/logs\/access\.?\d+\.log

Re: How to blacklist a single source path on a universal forwarder?

ddrillic — Fri, 03 Jun 2016 15:43:40 GMT

.? takes care of the optional dot...