topic whitelist syntax - inputs.conf in Getting Data In

whitelist syntax - inputs.conf

nathanlhopkins — Mon, 28 Sep 2020 13:56:16 GMT

I'd like to index files in /DIR/autosys/logs as below;

Linux equivalent:
cd /DIR/autosys/logs
ls app*ua1*START_MT*

Please can someone help me correct below:

[monitor:///DIR/autosys/logs]
whitelist = app\ua1\STOP_MT\$
disabled = false
index = test_index

Re: whitelist syntax - inputs.conf

dwaddle — Sun, 19 May 2013 01:11:43 GMT

This should work:

[monitor:///DIR/autosys/logs] 
whitelist = app.*ua1.*START_MT.*$
disabled = false 
index = test_index

Also, this should work just as well:

[monitor:///DIR/autosys/logs/app*ua1*START_MT*] 
disabled = false 
index = test_index

Whitelists and blacklists are just regular expressions. The equivalent to a * glob (shell expansion) is ".*". The best way to visualize how whitelists/blacklists work from a unix point of view is

find $STARTDIR -print | egrep "$WHITELIST" | egrep -v "$BLACKLIST"

Re: whitelist syntax - inputs.conf

nathanlhopkins — Mon, 28 Sep 2020 13:56:19 GMT

sorry - something seems to be wrong with pasting into these boxes - i'm after:

ls app*ua1*START_MT*

Re: whitelist syntax - inputs.conf

nathanlhopkins — Sun, 19 May 2013 21:35:49 GMT

sorry - I didn't realise markdown was removing my *'s - i'm after: ls app*ua1*START_MT*

Re: whitelist syntax - inputs.conf

dwaddle — Mon, 20 May 2013 04:21:09 GMT

easiest way to deal with the markdown formatting is to actually use a code block (4 spaces)

Re: whitelist syntax - inputs.conf

nathanlhopkins — Wed, 22 May 2013 19:19:11 GMT

Many thanks - I didn't really need the whitelist as you pointed out