Hi,
I have a situation where the logs files are created along with a date ex: error.log_2014-02-16.
I need to monitor these logs continuously. Each day there is a new file created in the folder how cam i do this on my forwarder.
And i need them to be indexed from present time or date since i don't need spending my license indexing old data.
Just monitor the whole directory, and use the ignoreOlderThan
directive in inputs.conf.
Something like this:
[monitor:///your/monitored/directory]
disabled = 0
ignoreOlderThan = 1d
This assumes you know that your forwarder will not be offline for longer periods of time though - if it is, be aware of that setting ignoreOlderThan
to 1d will cause it to ignore files older than that when it checks which files it should read events from.
Just monitor the whole directory, and use the ignoreOlderThan
directive in inputs.conf.
Something like this:
[monitor:///your/monitored/directory]
disabled = 0
ignoreOlderThan = 1d
This assumes you know that your forwarder will not be offline for longer periods of time though - if it is, be aware of that setting ignoreOlderThan
to 1d will cause it to ignore files older than that when it checks which files it should read events from.
You could also set a whitelist
with a regular expression to filter so you only get files that follow the format you have. That way you don't get any nasty surprises if someone puts other files in there.
thanks....