Inputs.conf monitoring of a Dir and a specific log within it

[Wilf]

What is the precedence? or will it creat problems if I am monitoring All files in directory and also monitor a specific file in that dir.

I need to tag this seperate from other syslog

[monitor:///log/new/local6]
sourcetype=syslog_local6

All remaining log files are generic syslog

[monitor:///log]
followTail=0
ignoreOlderThan=1d
recurse=true
sourcetype=syslog

[martin_mueller · Accepted solution]

Specify a blacklist entry in the generic stanza. Apart from what splunk would do, this makes it much more obvious to others trying to understand how your configuration works.