Hi guys,
Trying to make a custom blacklist for one of my input monitor points that excludes certain directories and filetypes (gz).
This is when I have so far:
[default]
host = myhost
[monitor:///my_monitor_point]
disabled = false
blacklist = (subfolder1|subfolder2|subfolder3|subfolder4|\.gz$|\.\d+$)
index = my_index
sourcetype = my_source_type
Can someone confirm if this is the correct way to do this?
Thanks.
Brian
yes, the above will work. However, it's probably unnecessary to specify the host
as it will be inherited or derived from the local machine name, unless you need it to be different. If you do, it may make sense to specify it under the [monitor] stanza rather than [default], but really it depends on the rest of your usage.
Note that your blacklist might be too broad, e.g., if one of your subfolders is called "bin", then you will also exclude any file named "binary.log" as well as everything in a directory named "bingo". You'd need to make your regex more specific if you want to avoid that happening.
yes, the above will work. However, it's probably unnecessary to specify the host
as it will be inherited or derived from the local machine name, unless you need it to be different. If you do, it may make sense to specify it under the [monitor] stanza rather than [default], but really it depends on the rest of your usage.
Note that your blacklist might be too broad, e.g., if one of your subfolders is called "bin", then you will also exclude any file named "binary.log" as well as everything in a directory named "bingo". You'd need to make your regex more specific if you want to avoid that happening.