Multiple Whitelists

[robertlynch2020]

Hi

I have the following two inputs in inputs.conf. They both work separably but not together.

**Working**
[monitor:///net/dell428srv/data2/apps/mx_ox62148_191418/logs_latest_17052017-064938.../*.log]
disabled = false
host = MXTIMING_TEST1_DELL428SRV
index = mlc_live
whitelist =  mxtiming_(?<FULL_STRING>\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING

**Working**
[monitor:///net/dell428srv/data2/apps/mx_ox62148_191418/logs_latest_17052017-064938.../*.log]
disabled = false
host = MXTIMING_TEST1_DELL428SRV
index = mlc_live
whitelist =  mxtiming_(?<FULL_STRING>[^_]*_[^_]*_\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING

When i try to add them together with a | nothing works, i have a few to add so i don't want to have to keep copying this code

    **NOT_WORKING**
    [monitor:///net/dell428srv/data2/apps/mx_ox62148_191418/logs_latest_17052017-064938.../*.log]
    disabled = false
    host = MXTIMING_TEST1_DELL428SRV
    index = mlc_live
    whitelist =  mxtiming_(?<FULL_STRING>\d*_[^_]*_\d*)\.log|mxtiming_(?<FULL_STRING>[^_]*_[^_]*_\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING

Any ideas would be great 🙂

[cpetterborg · Accepted solution]

Two things. First, your regex is invalid, you define FULL_STRING twice, which is not allowed in a regex. Since you aren't using a named capture group later, just get rid of it.

Second, parenthesis will be your friend. Try:

whitelist =  (mxtiming_(\d*_[^_]*_\d*)\.log)|(mxtiming_([^_]*_[^_]*_\d*_[^_]*_\d*)\.log))

But, you can't make it better:

whitelist = mxtiming_((\d*_[^_]*_\d)|([^_]*_[^_]*_\d*_[^_]*_\d*))\.log

I'm not sure why you don't just use:

whitelist = mxtiming_.*\.log

Which should work just as well, if you don't have a third name that uses mxtiming_*.log.

[robertlynch2020]

Thanks very much. In fact i went for the last option.

Cheers

[cpetterborg]

It is the easiest and will match other file names if they happen to change any in the future. I find it best to do that simplest version whenever possible. 🙂