elasticsearchlogstashfilebeat

Regex not worked in filebeat

I have issue in file as i want to exclude some file not to shipped to logstahs I'm using filebeat 8.3 and using below parameter to exclude any file starting with SLE. When running, the code snippet below will start filebeat successfully, but will still send .SLE files to Logstash.

filebeat.inputs:
- type: filestream
  paths:
    - "/path/to/your/logs/*.log"
  prospector.scanner.exclude_files: ['^SLE.*\.log$']
Solution

  • I believe exclude files is not applied to the filename but instead to the path so I replaced regex with ^'/app/softwareag/wm1011/IntegrationServer/instances/default/gc.*' and worked fine