...
You can filter out log events during collection so that some of the logs data will not be collected and available in XpoLog (alternatively it is also possible to mask data)
To set the data filter:
- Under Advanced Settings, click Data Filter.
The Data Filter definitions open. - Enter a search query that filters only events that should be collected from the log (events that don't satisfy the query will be ignored).
It is recommended to run the same query in the Search console prior to saving this filtering to ensure the result is the desired one.
...
- Sort physical files by – specify the option that will ensure that all the files in the log that are being captured are sorted correctly: last update time (default) or filename.
Note: It is recommended to order according to the last update time, because XpoLog assumes that one file is written and closed in the source log, before another is written and closed. - File rotation policy – define the nature of rotation between the captured files of the log:
- Cyclic – Files are overridden as part of the file rotation and log file names are modified during a rotation cycle.
- New appending – File names are unique and are not changed as part of the rotation; however, the list of files changes as new files are added.
- Static – The list of files never changes. Relevant for logs repository where the files are not changed.
- Get files information from - XpoLog retrieves information on files that are being collected in order to keep continuous collection (last modified time, file's size, etc.). In order to maximize efficiency, it is done by default on the directory level however in some cases (seen many times on Windows) the directory returns wrong information such as file size zero or an older last modified time - in such cases it is recommended to retrieve the information directly from the collected files which usually solves the case.
- Patent directory (default) - information retrieved from the parent directory.
- Each file directly - information retrieved directly from the files
- Add another log path– Clicking this link opens another Log path field, enabling you to add more than one source log into a single XpoLog log.
...
- Under Advanced Settings, click File Attributes.
The File Attributes definitions open. - In Sort physical files by, select Last update time or File name.
- In File rotation policy, select Cyclic, New appending, or Static.
- In Get files information from, select Parent directory (default) or Each file directly.
- If you want to import an additional log into the same XpoLog log, click Add another log path.
An additional Log path field opens for selecting another log file to import into the same log. - Repeat step 4 for all the source logs that you want to capture under the same XpoLog log.
...
- In the textbox within Include the last files, type the number of last files to include in the log
OR
In the textbox within Exclude the last files, type the number of last files to exclude from the log. - In the From the filter, select to filter the files from the last (default) or previous specified number of units of time – in the textbox, type the number of units of time and in the following dropdown list, select minutes, hours (default), days, weeks, or months.
- In With size, select equals, smaller than, smaller than or equals, greater than, greater than or equals, between, not equals, and in the following textbox, type the number of bytes.
Note: If you select between, type a range of bytes. - In Exclude name patterns, type the name patterns (separated by commas) of the files to exclude from the log. See XpoLog XPLG Patterns Language for syntax of name patterns.
...