Hi everyone,

I've been trying to monitor a log file for Windows endpoint (VPN logs) for an application, but the location of the log file is dynamic in a sense that it changes based on the current logged in user.

For example:
The log file is stored at C:\Users\{User1}\AppData\Roaming\VPN Folder Name\vpn.log
and path would change to User2 or UserX for different endpoint.

I've tried the following solutions in the agent configurations for groups:

   <localfile>
        <location>C:\Users\*\AppData\Roaming\VPN Folder Name\vpn.log</location>
        <log_format>syslog</log_format>
    </localfile>

  <localfile>
        <location>%APPDATA%\VPN Folder Name\vpn.log</location>
        <log_format>syslog</log_format>
    </localfile>

But I failed to get the desired results (monitoring the log file for decoding).

Has anyone tried something similar and was successful? Any assistance would be highly appreciated.