2017-10-18 9:27 GMT+02:00 mostolog--- via rsyslog <rsyslog@lists.adiscon.com>:
> It doesn't seem possible to exclude specific files when using directory
> wilcards too.
>
> eg: /logs/**/^{file_format_X.log}** is NOT supported as it would require us to put inotify handles over a very large directory set imfile uses this for obtaining the filename: https://linux.die.net/man/3/glob Rainer > > > Perhaps http://www.linuxjournal.com/content/bash-extended-globbing could do > the trick, but i was wondering if there won't make more sense to use REGEX > or exclude paratemer (or...) > > > Regards > > On 17/10/17 16:59, Rainer Gerhards wrote: >> >> You cannot exclude, bit you can include those that you want. I guess with >> ugly globbing that should be possible. Best try with ls first. >> >> http://tldp.org/LDP/abs/html/globbingref.html >> >> Sent from phone, thus brief. >> >> Am 17.10.2017 15:23 schrieb "mostolog--- via rsyslog" >> <rsyslog@lists.adiscon.com <mailto:rsyslog@lists.adiscon.com>>: >> >> Hi >> >> >> One of our relay rsyslog servers has 2 kind of logs: apache and >> java. Sadly, *not all java applications share the same log format.* >> >> We have solved this using a bash script to generate our config >> which has one input for each file. >> >> To avoid having to reconfigure rsyslog each time a log is created >> or an application is added/removed we though about using >> wildcards. More or less, this would result in: >> >> input( >> addMetadata="on" >> file="/logs/apache/*/*" >> persistStateInterval="3" >> ruleset="ruleset" >> tag="apache" >> type="imfile" >> ) >> input( >> addMetadata="on" >> file="/logs/java/*/*" >> persistStateInterval="3" >> readTimeout="5" >> ruleset="ruleset" >> startmsg.regex="^[[:digit:]]{2} [[:alpha:]]{3} [[:digit:]]{4}" >> tag="java" >> type="imfile" >> ) >> >> But, as stated before, *this would have conflicts with those files >> having a different multiline patterns*. For example: >> >> /logs/java/foo/foo.log >> startmsg.regex="^[[:digit:]]{2} [[:alpha:]]{3} [[:digit:]]{4}" >> /logs/java/bar/bar.log >> startmsg.regex="^[[:alpha:]]{3} [[:digit:]]{2}, >> [[:digit:]]{4}" >> /logs/java/other/other.log >> startmsg.regex="^[[:digit:]]{2}-[[:digit:]]{2}-[[:digit:]]{4}" >> /logs/java/one/one.log >> startmsg.regex="^[[:alpha:]]{4,5} >> [[:digit:]]{4}/[[:digit:]]{2}/[[:digit:]]{2}" >> /logs/java/two/two.log >> startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}" >> >> >> Is there any option to exclude this files from the wilcard? >> >> Couldn't wilcard accept a regex as pattern? Eg: all files except >> those in foo, or bar, or... >> file="/logs/java/((?!(foo|bar|other|one|two)).)*/.*" >> >> Any other solution? >> >> Regards >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> <http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/professional-services/ >> <http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT >> POST if you DON'T LIKE THAT. >> > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
