Which files count as logs
When Log Lens scans a directory, it doesn't try to read every file it finds. It first decides which files look like logs, using a single filename rule. Getting this rule right is what keeps your index full of real log data and free of README files, PID files, and other noise.
The pattern
Log Lens matches each file's name (not its contents) against a regular expression called log_file_pattern. The default is:
/\.log(?:\.\d+)?$/i
This is a PCRE with delimiters, matched case-insensitively. It accepts:
| Filename | Matches? | Why |
|---|---|---|
laravel.log | yes | ends in .log |
nginx-access.log | yes | ends in .log |
laravel.log.1 | yes | rotated file (.log + number) |
horizon.log.42 | yes | rotated file |
app.log.gz | no | ends in .gz, not .log |
notes.txt | no | not a log extension |
The (?:\.\d+)? part is what lets rotated logs through: many systems rename yesterday's app.log to app.log.1, app.log.2, and so on. Log Lens indexes those the same way it indexes the live file.
How scanning works
When you point Log Lens at a directory, it walks the whole tree recursively, testing every filename against the pattern. Two things are always skipped:
- Anything inside a
processed/folder (that's the archive of already-imported files). - Files whose names don't match the pattern.
Pointing directly at a single file also works, as long as its name matches the pattern.
Customizing it
If your logs use different extensions, widen the pattern in your configuration. For example, to also pick up .out and .err files (with rotation):
'ingestion' => [
'log_file_pattern' => '/\.(log|out|err)(?:\.\d+)?$/i',
],
The value is validated when it loads. If it's missing or not a usable regular expression, Log Lens quietly falls back to the built-in default, so a typo never leaves you with an empty scan.
The pattern is applied only during a scan. After widening it, point Log Lens at the directory again so the newly matching files get picked up.