How to properly glob k8s logs source?

[Quyzi]

I'm trying to get my kubernetes_logs source to properly exclude log files I'm not interested in. I have a list of keywords that need to be part of the file path, and it should also not watch files that were logrotated or dated.

vector v0.24.2

The filename keywords I'm trying to include are

• k8s-secrets-controller
• zk-bridge
• k8s-vault-updater
• synapse
• envoy

To do this I've added two exclude globs to my source

"sources":
  "stdout_logs":
    "exclude_paths_glob_patterns":
      - "**/*[!.log]"
      - "/var/log/pods/*/!(k8s-secrets-controller|zk-bridge|k8s-vault-updater|synapse|envoy)/*",
    "type": "kubernetes_logs"

However, I'm still seeing vector logs showing it's watching files that should be excluded. I'm not sure if I've done this right.

[davidhuie-dd]

Do you have an example of a full path of a file that you're trying to exclude?

[Quyzi]

Hi, yes, here is an example of a full file path I'm trying to exclude
/var/log/pods/job-manager-dev_job-manager-6d99667f89-p6cm3_4304234f-5668-3214-ffff-d7d234f833fc/job-manager/1.log

2023-02-02T21:02:22.650304Z  INFO source{component_kind="source" component_id=stdout_logs component_type=kubernetes_logs component_name=stdout_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/job-manager-dev_job-manager-6d99667f89-p6w5m_4304ef6f-5738-4d67-94cf-d7d134f835db/job-manager/1.log

For context, I have vector deployed as a sidecar, but there are some containers that aren't able to use the sidecar model. For those, we have vector deployed as a daemonset, which is where this glob is living. I want to keep stdout logging enabled, so I can still use kubectl logs but I also need some of those logs to go to my log sink.