- What's New
- Function Overview
- Service Overview
- Getting Started
-
User Guide
- Log Management
-
Log Ingestion
-
Ingesting Cloud Service Logs to LTS
- Ingesting AOM Logs to LTS
- Ingesting APIG Logs to LTS
- Ingesting BMS Text Logs to LTS
- Ingesting CBH Logs to LTS
- Ingesting CCE Application Logs to LTS
- Ingesting CFW Logs to LTS
- Ingesting CTS Logs to LTS
- Ingesting GaussDB(DWS) Logs to LTS
- Ingesting ECS Text Logs to LTS
- Ingesting ELB Logs to LTS
- Ingesting Enterprise Router Logs to LTS
- Ingesting FunctionGraph Logs to LTS
- Ingesting ModelArts Logs to LTS
- Ingesting SMN Logs to LTS
- Ingesting SecMaster Logs to LTS
- Ingesting ServiceStage Containerized Application Logs to LTS
- Ingesting ServiceStage Cloud Host Logs to LTS
- Ingesting VPC Logs to LTS
- Ingesting WAF Logs to LTS
- Using APIs to Ingest Logs to LTS
- Other Ingestion Modes
- Setting ICAgent Structuring Parsing Rules
-
Ingesting Cloud Service Logs to LTS
- Host Management
-
Log Search and Analysis
- Overview
- Setting Cloud Structuring Parsing
- Setting Indexes
- Searching Logs
- Viewing Real-Time Logs
- Analyzing Logs in LTS
-
SQL Analysis Syntax
- Overview
- SQL Aggregate Functions
- SQL Period-over-Period Functions
- SQL JSON Functions
- SQL IP Functions
- SQL Mathematical Functions
- SQL Time Functions
- SQL Extrema Functions
- SQL String Functions
- SQL SPLIT Functions
- SQL Comparison Operators
- SQL IP Address Functions
- SQL Reduction Functions
- Other SQL Functions
- SQL JOIN Syntax
- SQL Query Example
-
Log Visualization
- Overview
- Visualizing Logs in Statistical Charts
-
Visualizing Logs in Dashboards
- Creating a Dashboard
- Adding a Dashboard Filter
-
Dashboard Templates
- APIG Dashboard Templates
- CCE Dashboard Templates
- CDN Dashboard Templates
- CFW Dashboard Templates
- CSE Dashboard Templates
- DCS Dashboard Template
- DDS Dashboard Template
- DMS Dashboard Template
- DSL Dashboard Template
- ER Dashboard Template
- METRIC Dashboard Template
- Nginx Dashboard Templates
- VPC Dashboard Template
- WAF Dashboard Templates
- Log Alarms
- Log Transfer
- Log Processing
- Configuration Center
- API Reference
- Best Practices
-
FAQs
- Overview
- Consultation
-
Host Management
- What Do I Do If ICAgent Installation Fails in Windows and the Message "SERVICE STOP" Is Displayed?
- What Do I Do If ICAgent Upgrade Fails on the LTS Console?
- What Do I Do If I Could Not Query New Logs on LTS?
- What Do I Do If ICAgent Restarts Repeatedly After Being Installed?
- What Do I Do If ICAgent Is Displayed as Offline on the LTS Console After Installation?
- What Do I Do If I Do Not See a Host with ICAgent Installed on the LTS Console?
- How Do I Create a VPC Endpoint on the VPCEP Console?
- How Do I Obtain an AK/SK Pair?
- How Do I Install ICAgent by Creating an Agency?
-
Log Ingestion
- What Do I Do If LTS Cannot Collect Logs After I Configure Host Log Ingestion?
- Will LTS Stop Collecting Logs After the Free Quota Is Used Up If I Disable "Continue to Collect Logs When the Free Quota Is Exceeded" in AOM?
- What Do I Do If the CPU Usage Is High When ICAgent Is Collecting Logs?
- What Kinds of Logs and Files Does LTS Collect?
- How Do I Disable the Function of Collecting CCE Standard Output Logs to AOM on the LTS Console?
- How Long Does It Take to Generate Logs After Configuring Log Ingestion?
- What Do I Do If LTS Cannot Collect Logs After I Configure Log Ingestion with ICAgent?
- Log Search and Analysis
- Log Transfer
- SDK Reference
- Videos
Setting Structured and Tag Fields
Setting Structured Fields
You can set extracted fields after cloud structuring. For details, see Table 1.
Template Name |
Field Name |
Field Type Can Be Changed |
Field Can Be Deleted |
---|---|---|---|
Regular expressions (auto generate) |
User-defined. The name must start with a letter and contain only letters and digits. |
Yes |
Yes |
Regular expressions (manually enter) |
|
Yes |
Yes |
JSON |
Names are set automatically, but you can set aliases for fields. |
Yes |
Yes |
Delimiter |
Default names such as field1, field2, field3 are used. You can modify these names. |
Yes |
Yes |
Nginx |
Names are set based on Nginx configuration, but you can set aliases for fields. |
Yes |
Yes |
Custom templates |
User-defined. |
Yes |
Yes |
When you use regular expressions (manually entered), JSON, delimiters, Nginx, or custom templates to structure logs, field names:
- Can contain only letters, digits, hyphens (-), underscores (_), and periods (.).
- Cannot start with a period (.) or underscore (_) or end with a period (.).
- Can contain 1 to 64 characters.
Setting Tag Fields
When you structure logs, you can configure tag fields, so you can use these fields to run SQL queries on the Visualization page.
- In Step 2 Extract fields, click the Tag Fields tab and Add Field.
- In the Field column, enter a name for the tag field, for example, hostIP.
NOTE:
If you configure tag fields for a structuring rule that was created before the function of tag fields was brought online, no example values will be shown with the tag fields.
- To add more fields, click Add Field.
- Click Save.
NOTE:
- Tag fields can be the following system fields: category, clusterId, clusterName, containerName, hostIP, hostId, hostName, nameSpace, pathFile, and podName.
- Tag fields cannot be the following system fields: groupName, logStream, lineNum, content, logContent, logContentSize, and collectTime.
- You can configure both field extraction and tag fields during log structuring.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.