Why is my monitor with a whitelist not picking up files?

[a212830]

Hi,

I have a monitor and a whitelist that aren't picking up my required files, and I'm not sure why.

Here's my inputs:

[monitor:///xt*q*/log/app/XTRAC/*/XTRA*1/xen/]
index = Xtrac_ceops_qa_wf_logs
disabled = false
followtail = 0
sourcetype = xtrac_xenlogs
whitelist = \*.log$

Here's the path to the files: /xt113qdal0/log/app/XTRAC/6.9.1.1/XTRAC6.9.1.1_ClusterMbr1/xen

I only want the "Mbr1" directory, hence the wildcard, but nothing in there is getting picked up.

[MuS · Accepted solution]

Hi a212830,

your whitelist regex is not matching, because this regex \*.log$ will match in a list of three value the last:

file.log <- no match
*file.log <- no match
*.log  <- this will match

This is because the regex \* will match a literal asterisk / star / wildcard and I don't think you wanted that?

Hope this helps ...

cheers, MuS

[a212830]

Duh. Thanks!