Getting Data In

Stanza to select Nginx log files

hbacbs
Explorer

I want to forward some Nginx log files. Nginx log files look like:
- server-access.log
- server-access.log-20180102
- server-access.log-20180101.gz
I configured inputs.conf
[monitor:////var/log/nginx/server-access.log*]
index = server-index

But I didn't receive any events. It works without the wildcard.

According to the documentation (1) the stanza [monitor:////var/log/nginx/server-access.log*] is translated to
[monitor:////var/log/nginx]
whitelist = server-access.log[^/]*$

Specifying the whitelist does the job. My question is what is wrong with server-access.log*

(1): http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Specifyinputpathswithwildcards

0 Karma
1 Solution

markusspitzli
Communicator

I'm not sure but I think you have a / to much in your stanza. It should look like this:
[monitor:///var/log/nginx/server-access.log*]

If this still not works I would make two stanzas:

[monitor:///var/log/nginx/server-access.log]
[monitor:///var/log/nginx/server-access.log-*]

View solution in original post

0 Karma

markusspitzli
Communicator

I'm not sure but I think you have a / to much in your stanza. It should look like this:
[monitor:///var/log/nginx/server-access.log*]

If this still not works I would make two stanzas:

[monitor:///var/log/nginx/server-access.log]
[monitor:///var/log/nginx/server-access.log-*]

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>