need help setting up a blacklist

[balbano]

Hi guys,

Trying to make a custom blacklist for one of my input monitor points that excludes certain directories and filetypes (gz).

This is when I have so far:

inputs.conf

[default]

host = myhost

[monitor:///my_monitor_point]

disabled = false

blacklist = (subfolder1|subfolder2|subfolder3|subfolder4|\.gz$|\.\d+$)


index = my_index


sourcetype = my_source_type

Can someone confirm if this is the correct way to do this?

Thanks.

Brian

[gkanapathy · Accepted solution]

yes, the above will work. However, it's probably unnecessary to specify the host as it will be inherited or derived from the local machine name, unless you need it to be different. If you do, it may make sense to specify it under the [monitor] stanza rather than [default], but really it depends on the rest of your usage.

Note that your blacklist might be too broad, e.g., if one of your subfolders is called "bin", then you will also exclude any file named "binary.log" as well as everything in a directory named "bingo". You'd need to make your regex more specific if you want to avoid that happening.