topic Re: File monitoring in inputs.conf in Getting Data In

File monitoring in inputs.conf

Boopalan — Fri, 12 Apr 2019 15:47:22 GMT

I want to configure an file in a directory which will be rolling over to new file within 2mins.
I tried basic inputs.conf as below, its working fine but its missing files which was rolled in to new For example, test.log is the file I want to continuously monitor, this test.log will be renamed as test-1.log within 2 mins and new datas will be written in test.log. My config is monitoring test.log once and after 6mins only test.log is again reading i.e., in between test-2.log created in 4th min and test-3.log in 6th min is ignored. I want to configure to monitor only test.log without any loss of data on it.
Note: logs are placed in *nix systems

inputs.conf used:

[monitor:///opt/sample/logs/test*.log]
index = test
disabled = false
sourcetype = test_logs
blacklist = (test*-\d{1,2}\.log$)
ignoreOlderThan = 30d
crcSalt = <SOURCE>

Re: File monitoring in inputs.conf

somesoni2 — Fri, 12 Apr 2019 16:04:23 GMT

Try this

[monitor:///opt/sample/logs/test*.log]
 index = test
 sourcetype = test_logs
 ignoreOlderThan = 30d

Re: File monitoring in inputs.conf

woodcock — Sat, 13 Apr 2019 17:54:32 GMT

Like this:

[monitor:///opt/sample/logs/test*.log]
index = test
disabled = false
sourcetype = test_logs
blacklist = (test*-\d{2,}\.log$)

DEFINITELY DO NOT USE THESE:

ignoreOlderThan = 30d
crcSalt = <SOURCE>