topic Re: Whitespace before closing bracket: An Issue? in Getting Data In

Whitespace before closing bracket: An Issue?

morethanyell — Fri, 08 Feb 2019 05:34:07 GMT

My Fowarder App is 1.) Deployed 2.) Reloaded 3.) Phoned-in...but still no logs coming in. Here's the inputs.conf just deployed few minutes ago:

[monitor:///Some/Directory/*.logs ]
index = some_index
sourcetype = some_sourcetype
blacklist = .(gz|tar|tgz|zip|bkz|arch|etc|tmp|swp|nfs|swn)$

Is the whitespace after ..logs and before the ] our culprit? Needed confirmation.

Thanks in advance.

p.s. To those who would advice "why not just remove it and then see what happens". Yes, we will do it but our dev-ops process will not be able to pull the code into master until Monday and deploy until Tuesday next week. Thank you for understanding.

p.p.s. the directory has logs in it

Re: Whitespace before closing bracket: An Issue?

MuS — Fri, 08 Feb 2019 05:49:05 GMT

Hi morethanyell,

two things I can think of:

changes on inputs.conf most likely require a restart
your p.s. solution is probably the solution anyway 😉

cheers, MuS

Re: Whitespace before closing bracket: An Issue?

morethanyell — Fri, 08 Feb 2019 05:51:33 GMT

We've restarted already, still the same. Anyways, Thanks @MuS

Re: Whitespace before closing bracket: An Issue?

woodcock — Fri, 08 Feb 2019 16:26:44 GMT

It should not be a problem (but I'd fix it anyway).

Re: Whitespace before closing bracket: An Issue?

morethanyell — Tue, 12 Feb 2019 03:32:34 GMT

Update: It was fixed by removing the space.

Re: Whitespace before closing bracket: An Issue?

woodcock — Tue, 12 Feb 2019 04:09:13 GMT

Wow. Crazy.

Re: Whitespace before closing bracket: An Issue?

markusspitzli — Tue, 19 Feb 2019 06:36:44 GMT

Whitespaces do matter in the inputstanza. According to the documentation I would assume that any character between monitor:// and ]is considered as <path>

[monitor://<path>]
* <path> can be an entire directory or a single file.