Getting Data In

Stanza to select Nginx log files

hbacbs
Explorer

I want to forward some Nginx log files. Nginx log files look like:
- server-access.log
- server-access.log-20180102
- server-access.log-20180101.gz
I configured inputs.conf
[monitor:////var/log/nginx/server-access.log*]
index = server-index

But I didn't receive any events. It works without the wildcard.

According to the documentation (1) the stanza [monitor:////var/log/nginx/server-access.log*] is translated to
[monitor:////var/log/nginx]
whitelist = server-access.log[^/]*$

Specifying the whitelist does the job. My question is what is wrong with server-access.log*

(1): http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Specifyinputpathswithwildcards

0 Karma
1 Solution

markusspitzli
Communicator

I'm not sure but I think you have a / to much in your stanza. It should look like this:
[monitor:///var/log/nginx/server-access.log*]

If this still not works I would make two stanzas:

[monitor:///var/log/nginx/server-access.log]
[monitor:///var/log/nginx/server-access.log-*]

View solution in original post

0 Karma

markusspitzli
Communicator

I'm not sure but I think you have a / to much in your stanza. It should look like this:
[monitor:///var/log/nginx/server-access.log*]

If this still not works I would make two stanzas:

[monitor:///var/log/nginx/server-access.log]
[monitor:///var/log/nginx/server-access.log-*]

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...