Monitor_create

This tag is used to monitor a set of files for changes, it can detect new files that have appeared since after the time you said to create the monitor that fit the same pattern. There are two other tags that can be used in conjunction with this one they are monitor_grep and monitor_destroy.

After you're done with a monitor make sure to clean it up using the monitor_destroy tag. The other grep tag will allow you to take all of the files that have changed since the time of the monitor_create to the time of the monitor_grep is called and to check if there are any new lines that match a specific pattern. For more information on using monitor_grep read its documentation.

The unique identifier for this monitor that is being created.

file

The file pattern to monitor, you can use a syntax like so: /var/log/syslog.* or just a plain /var/log/my.log.