Regex for Log source

[Shal]

Hi Team,

I am trying to add below log file in Custom log source

D:\xxx\Apps\BusSys_UAT_OC5\xxx.BLT.BulkImportServerWS\2025.4.24.1-mainBulkLoadTool-OC5\logs\2025-04-24\log.txt 

The words highlighted in red change according to the date the folder and file are generated.

Can someone suggest how I can add a custom log for this pattern?

I tried ones below 

• D:\xxx\Apps\BusSys_UAT_OC5\xxx.BLT.BulkImportServerWS
  \2025.4.24.1-mainBulkLoadTool-OC5\logs\*\log* 
• D:\xxx\Apps\BusSys_UAT_OC5\Merchants.BLT.BulkImportServerWS\
  2025.4.24.1-mainBulkLoadTool-OC5\logs\xxx\*.txt
• D:\xxx\Apps\BusSys_UAT_OC5\xxx.BLT.BulkImportServerWS\
  *\logs\*\*.txt

It either shows No log data or the file does not exist.

[Joachim_Erdei]

Hi Shal,

the last one looks OK. (You can think of it as patterns for searching files on disk.) Have you created an ingest rule to ingest this custom log source?

[Shal]

Hi Joachim,

Yes I have added custom log source as well as log ingestion rule as below:

Log source is any of : D:\XXX\Apps\BusSys_UAT_OC5\Merchants.BLT.BulkImportServerWS\*\logs\*\*.txt

Thanks

[Joachim_Erdei]

Hi Shal,

just to be clear, is "xxx" in your paths a replacement for something sensitive, or a part that might have multiple values (like a wildcard)? If taken literally, please note that you log ingest rule covers the second of custom log sources in the first post, and the rest are not matched (Merchants vs xxx).

Can you say what is the exact full path to the log file you try to ingest? Knowing that I could match it with the rules.

[Shal]

Hi Joachim,

Yes, sorry for the confusion. You can consider the actual file path as below:

D:\Merchants\Apps\BusSys_UAT_OC5\Merchants.BLT.BulkImportServerWS\2025.4.24.1-mainBulkLoadTool-OC5\logs\2025-04-24\log.txt 

The text highlighted in red generates based on date . Sometimes instead of log.txt there can be files like log.00001.txt or log.00002.txt also.

That is the reason am considering it as wildcards and added the below rule .

Just checking if the custom log source and rule can be added as below  so that if there is any recent file it can capture it.

D:\Merchants\Apps\BusSys_UAT_OC5\Merchants.BLT.BulkImportServerWS\*\logs\*\*.txt

Thanks!

[Joachim_Erdei · Accepted solution]

It looks to me that the custom log source rule is perfectly OK. Please remember that custom log source name (not the file name) is your "log.source" attribute, which you can choose in your ingest rules.

Just for your information - you should also have a built-in rule (disabled on default) which ingests all custom log sources - you can just enable it if you find it suitable.