Vars in acquis.yaml

crowdsec
1

Hi,
I have an Rsyslog central server and I set logs by date.

I want to define path of adquisition files in “acquis.yaml” with a formated date var included (/logs/20241107).

Can I set in acquis.yaml file configuration in this way?

filenames:

  • /logs/date +%Y%M%d/auth.log

Best Regards,
Alberto

2

Under the hood we use golang filepath globbing syntax as shown here

Unfortunately there is no support for dates, so you can do /logs/*/auth.log, however, a downside is this will load all files. The only other way would be to have a symlink at the root of the directory that points towards the latest file EG:

$ ls -la /log/
current.log -> /log/20241107/auth.log
20241107/
20241106/

then you can setup the acquisition to be able to follow the symlinks if you dont want to load all files.