monitor stanza - help

[rakesh_498115]

Hi.

I have a common log path in my server say logs/project1/ which has perflogs and debuglogs i.e like this Appt_Perflog_ms1,Appt_Perflog_ms2 .. ,ABC_Perflog_ms1,ABC_Debug_ms1.txt .. Now i need these logs i.e perflogs to move to perf index and debug to debug index. so for that i have used the following monitor stanza.

[monitor:///logs/project1/*_Debug_ms*.txt]
blacklist = \.(gz)$
whitelist = ABC_Debug_ms[1-4]{1}.txt$ 
disabled = false
followTail = 0
recursive = false
sourcetype = debug_log
index = debuglogs



[monitor:///logs/project1/*_Perflog_ms*.txt]
blacklist = \.(gz)$
whitelist = (Appt_Perflog_ms[1-4]{1}.txt$ | ABC_Perflog_ms[1-4]{1}.txt$ )
disabled = false
followTail = 0
recursive = false
sourcetype = perf_log
index = perflogs

but this seems to be not working ?? any clue what happened here ?? is the **_* in monitor stanza causing this issue..pls help me..

[lukejadamec]

You don't need the '_'. Have you tried this?

[monitor:///logs/project1/*Debug*.txt]

[monitor:///logs/project1/*Perflog*.txt]