Stanza to select Nginx log files

hbacbs — Tue, 29 Sep 2020 19:12:06 GMT

I want to forward some Nginx log files. Nginx log files look like:
- server-access.log
- server-access.log-20180102
- server-access.log-20180101.gz
I configured inputs.conf [monitor:////var/log/nginx/server-access.log*] index = server-index

But I didn't receive any events. It works without the wildcard.

According to the documentation (1) the stanza [monitor:////var/log/nginx/server-access.log*] is translated to [monitor:////var/log/nginx] whitelist = server-access.log[^/]*$

Specifying the whitelist does the job. My question is what is wrong with server-access.log*

(1): http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Specifyinputpathswithwildcards

Re: Stanza to select Nginx log files

markusspitzli — Fri, 22 Feb 2019 13:56:22 GMT

I'm not sure but I think you have a / to much in your stanza. It should look like this:
[monitor:///var/log/nginx/server-access.log*]

If this still not works I would make two stanzas:

[monitor:///var/log/nginx/server-access.log]
[monitor:///var/log/nginx/server-access.log-*]

topic Re: Stanza to select Nginx log files in Getting Data In

Stanza to select Nginx log files

Re: Stanza to select Nginx log files