Begin monitoring files in a folder which is created every day With diff name.

[krish3]

Hi,

I have a situation where the logs files are created along with a date ex: error.log_2014-02-16. I need to monitor these logs continuously. Each day there is a new file created in the folder how cam i do this on my forwarder.

And i need them to be indexed from present time or date since i don't need spending my license indexing old data.

[Ayn · Accepted solution]

Just monitor the whole directory, and use the ignoreOlderThan directive in inputs.conf.

Something like this:

[monitor:///your/monitored/directory]
disabled = 0
ignoreOlderThan = 1d

This assumes you know that your forwarder will not be offline for longer periods of time though - if it is, be aware of that setting ignoreOlderThan to 1d will cause it to ignore files older than that when it checks which files it should read events from.

[laserval]

You could also set a whitelist with a regular expression to filter so you only get files that follow the format you have. That way you don't get any nasty surprises if someone puts other files in there.

[krish3]

thanks....