Regex not worked in filebeat

Question

I have issue in file as i want to exclude some file not to shipped to logstahs I'm using filebeat 8.3 and using below parameter to exclude any file starting with SLE. When running, the code snippet below will start filebeat successfully, but will still send .SLE files to Logstash.

filebeat.inputs:
- type: filestream
  paths:
    - "/path/to/your/logs/*.log"
  prospector.scanner.exclude_files: ['^SLE.*\.log$']

Answer 1

I believe exclude files is not applied to the filename but instead to the path so I replaced regex with ^'/app/softwareag/wm1011/IntegrationServer/instances/default/gc.*' and worked fine

Answer 2

The prospector.scanner.exclude_files option is not available in Filebeat 8.3. Instead, you should use the exclude_files option under the filestream input type. Here is how you can modify your configuration:

filebeat.inputs:
- type: filestream
  paths:
    - "/path/to/your/logs/*.log"
  exclude_files: ['^SLE.*\.log$']

Regards