blacklist not working

[a212830]

Hi,

I have an inputs.conf that is picking up a file that I want blacklisted. The file name is summary_1.diag. I thought this would filter it out. Any suggestions?

[monitor://F:\IBM\Lotus\Domino\Trace\*.diag]
sourcetype = STCommunityTraceLogs_diag
index = euc_sametimedata
disabled = false
followTail = 0
crcSalt = <SOURCE>
blacklist = summary_*.diag

[kristian_kolb]

I think that your problem lies in the blacklist regex;

* is a quantifier which means 'match the preceding character zero or more times', and . (dot) means 'match any character' (including a literal dot). So summary_*.diag means summary followed by zero or more underscores, followed by a single character, followed by diag. This will match the following (and a lot of other strings);

summary.diag
summary_1diag
summary____Gdiag

However, it can not match summary_1.diag. A regex that matches summary_, followed by numbers, followed by .diag would look like;

summary_\d+\.diag

/K