topic Re: Input paths with wildcards for the sub-directories tree in Getting Data In

Input paths with wildcards for the sub-directories tree

mlevsh — Tue, 26 Nov 2019 22:34:16 GMT

Hi,

I haven't dealt a lot with wildcards in Paths for Inputs, so will appreciate your help.

We need to monitor logs in SyslogLog sub-directory:

/opt/our-application/var/log/our-processor/message_logging/dev/<environment>/<proxy-name>/<revision>/SyslogLog/name_of_log.log

For example from the following available directories we need to get only 1),4), 5) and 7) ,8), 10)files

1) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log
2) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log.1
3) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log.2
4) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/2/SyslogLog/name_of_2_log.log
5) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/3/SyslogLog/name_of_3_log.log
6) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/3/FastLog/name_of_4_log.log

7) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/1/SyslogLog/name_of_5_log.log
8) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/2/SyslogLog/name_of_6_log.log
9) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/3/FastLog/name_of_7_log.log
10) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/4/SyslogLog/name_of_8_log.log

Will the following template on the Path with "*" work?

[monitor:///opt/our-application/var/log/our-processor/message_logging/dev/*/*/SyslogLog/*.log]
index = our_index
sourcetype = our_sourcetype

Re: Input paths with wildcards for the sub-directories tree

woodcock — Tue, 26 Nov 2019 22:56:26 GMT

Missed it by >that< much; try this:

[monitor:///opt/our-application/var/log/our-processor/message_logging/dev/*/*/*/SyslogLog/*.log]
index = our_index
sourcetype = our_sourcetype

Re: Input paths with wildcards for the sub-directories tree

woodcock — Tue, 26 Nov 2019 22:57:05 GMT

This assumes that .../dev/dev/... is really the path and not a double-paste error.

Re: Input paths with wildcards for the sub-directories tree

mlevsh — Wed, 27 Nov 2019 02:49:34 GMT

@woodcock , thank you! Will test tomorrow!
.../dev/dev/... is really the path.
it is possible that users might have other sub-folders under first dev.
Something like .../dev/dev_pse/...

Re: Input paths with wildcards for the sub-directories tree

mlevsh — Wed, 11 Dec 2019 17:06:39 GMT

@woodcock , sorry for a delay.
Tested and it worked. Thank you so much as always!