Skip to content

Fix whitelist monitor path and disabled flags - #138

Merged
dmitryax merged 14 commits into
mainfrom
fix-whitelist-monitor-path
Sep 10, 2026
Merged

Fix whitelist monitor path and disabled flags#138
dmitryax merged 14 commits into
mainfrom
fix-whitelist-monitor-path

Conversation

@omrozowicz-splunk

@omrozowicz-splunk omrozowicz-splunk commented Sep 9, 2026

Copy link
Copy Markdown
Collaborator

This PR:

  • Fix whitelist/blacklist handling for monitor and batch stanzas: Splunk TA default stanzas typically set whitelist to a PCRE regex (e.g. (\.log|log$|messages|secure|auth)). Previously this regex was joined to the monitored path and passed to filelog as a glob, which never matched anything. Now whitelist/blacklist values are always treated as PCRE regexes per Splunk docs and applied as stanza filter operators on log.file.path.
  • Fix directory paths without whitelist: A monitor stanza pointing at a plain directory with no whitelist param now correctly expands to dir/* so filelog can match files inside it.
  • Fix disabled=true not being recognised: IsDisabled() previously only handled disabled=1; it now also handles disabled=true.
  • Deduplicate shared logic: Extracted ApplyIncludeExclude and ApplyStanzaConfig into a shared pkg/splunkta/receiver/filter package used by both monitorreceiver and batchreceiver.

Comment thread pkg/splunkta/receiver/filter/filter.go Outdated
// glob patterns (containing *, ?, or [) or PCRE regexes (containing (, |,
// $, or \). The latter are not valid globs and must not be passed to filelog.
func IsGlobPattern(s string) bool {
return s != "" && strings.ContainsAny(s, "*?[") && !strings.ContainsAny(s, "(|$\\")

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this will return true for some regex which can include *, [.

For example, .*log, foo.*bar, and [0-9]+ are valid regular expressions, but this function returns true for them. They are then passed to filelog as globs and no regex filter is added.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

from splunk's documentation looks like whitelist is:

whitelist = <your_custom regex>

so I think we can assume it is always a regex

@omrozowicz-splunk
omrozowicz-splunk marked this pull request as ready for review September 10, 2026 12:53
@dmitryax
dmitryax merged commit 59b246c into main Sep 10, 2026
9 checks passed
@dmitryax
dmitryax deleted the fix-whitelist-monitor-path branch September 10, 2026 17:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants