regex question in inputs.conf

[a212830]

Hi,

How would I setup a monitor in inputs.conf that looks for files that begin with "system-" and will process everything (same directory) except files that have a "#" anywhere in them after the "system-" ?

I don't want "system-#blahblah.log" or "system-(#junk.log".

[peopleware]

a regex that will identify such strings is:

^system-.*#

The '^' indicates beginning of line
The '\' ensure misinterpretation of special character like '-' or '#'
'.*' means any substring of length 0 or more

[dmaislin_splunk]

[monitor:///path/to/my/logdir]
sourcetype=mysourcetype
recursive = false
blacklist = (.+#.+\.log)$