Minimally now that I have
"file_glob": "/bro/logs/*/notice.*gz",
"recent_file_glob": "/bro/logs/%Y-%m-%d/notice.*gz",
Currently if recent_file_glob is missing, it can just default to file_glob. However, if only recent_file_glob is present, one could just convert the %X to * giving /bro/logs/*-*-*/notice.*gz which would also work in place of file_glob, so both are probably not needed.
Minimally now that I have
Currently if
recent_file_globis missing, it can just default tofile_glob. However, if onlyrecent_file_globis present, one could just convert the%Xto*giving/bro/logs/*-*-*/notice.*gzwhich would also work in place offile_glob, so both are probably not needed.