Setting a Structuring Template

System Templates

You can choose from multiple system templates, but cannot modify the field types in them or delete the fields. For details, see Table 1.

1. Log in to the LTS console. The Log Management page is displayed by default.
2. Click the target log group or log stream to access the log stream details page.
3. On the Log Search tab page, click Log Settings in the upper right corner. On the displayed page, click the Cloud Structuring Parsing tab to configure log structuring.
4. On the Cloud Structuring Parsing tab page, select Structuring Template.
5. Under Select Template, click System templates and select a template. A sample log event is displayed for each template. You can directly use the sample log event.

6. View the log parsing results in the Template Details table.
   • If you select a system template for structuring, it uses the custom log time. You can search for a template by template name to quickly query its information.
   • Fields of the string type do not support range query using the >, =, or < operators or the "in" syntax. Use asterisks (*) or question marks (?) for fuzzy query. You need to reconfigure the structuring and change the value of this field to a number.

   Table 1 System templates

   Template Name	Template Description	Field Type Can Be Changed	Field Can Be Deleted	Request Parameter
   ELB	Defined by ELB.	No	No	ELB
   VPC	Defined by VPC.	No	No	VPC
   CTS	Keys in JSON log events.	No	No	CTS
   APIG	Defined by APIG.	No	No	APIG
   DCS audit logs	Defined by DCS.	No	No	DCS_AUDIT
   TOMCAT	Defined by Tomcat.	No	No	TOMCAT
   Nginx	Defined by Nginx.	No	No	Nginx
   GAUSSV5 audit logs	Defined by GAUSSV5.	No	No	GAUSSDB_OPENGAUSS_AUDIT
   DDS audit logs	Defined by DDS.	No	No	DDS_AUDIT
   DDS error logs	Defined by DDS.	No	No	MONGODB_ERROR
   DDS slow query logs	Defined by DDS.	No	No	MONGODB_SLOW
   CFW access control logs	Defined by CFW.	No	No	CFW_ACCESS
   CFW attack logs	Defined by CFW.	No	No	CFW_ATTACK
   CFW traffic logs	Defined by CFW.	No	No	CFW_FLOW
   MySQL error logs	Defined by MySQL.	No	No	MYSQL_ERROR
   MySQL slow query logs	Defined by MySQL.	No	No	MYSQL_SLOW
   POSTGRESQL slow query logs	Defined by PostgreSQL.	No	No	POSTGRESQL_SLOW
   POSTGRESQL error logs	Defined by PostgreSQL.	No	No	POSTGRESQL_ERROR
   PostgreSQL database audit logs	Defined by PostgreSQL.	No	No	POSTGRESQL_AUDIT_LOG
   SQLServer error logs	Defined by SQL Server.	No	No	SQLSERVER_ERROR
   GeminiDB Redis slow query logs	Defined by GeminiDB Redis.	No	No	GAUSSDB_REDIS_SLOW
   CDN	Defined by CDN.	No	No	CDN
   SMN	Defined by SMN.	No	No	SMN
   GAUSSDB_MYSQL error logs	Defined by GaussDB(for MySQL).	No	No	GAUSSDB_MYSQL_ERROR
   GaussDB_MySQL slow query logs	Defined by GaussDB(for MySQL).	No	No	GAUSSDB_MYSQL_SLOW
   ER Enterprise Router	Defined by Enterprise Router.	No	No	ER
   MySQL audit logs	Defined by MySQL.	No	No	MYSQL_AUDIT
   GeminiDB Cassandra slow query logs	Defined by GeminiDB Cassandra.	No	No	GAUSSDB_CASSANDRA_SLOW
   GeminiDB Mongo slow query logs	Defined by GeminiDB Mongo.	No	No	GAUSSDB_MONGO_SLOW
   GeminiDB Mongo error logs	Defined by GeminiDB Mongo.	No	No	GAUSSDB_MONGO_ERROR
   WAF access logs	Defined by WAF.	No	No	WAF_ACCESS
   WAF attack logs	Defined by WAF.	No	No	WAF_ATTACK
   DMS rebalancing logs	Defined by DMS.	No	No	DMS_REBALANCED
   CCE audit logs	Defined by CCE.	No	No	CCE_AUDIT
   CCE event logs	Defined by CCE.	No	No	CCE_EVENT
   CCE NGINX-INGRESS logs	Defined by CCE.	No	No	NGINX_INGRESS
   GeminiDB Redis audit logs	Defined by GeminiDB Redis.	No	No	GAUSSDB_REDIS_AUDIT
   Influx slow query logs	Defined by Influx.	No	No	GAUSSDB_INFLUX_SLOW
   METRIC system logs	Defined by the monitoring log fields filtered by the metric generation task.	No	No	SYS_LOG_FOR_LOG2METRIC
   Microgateway	Defined by Microgateway.	No	No	MICROGATEWAY
   GeminiDB Mongo audit logs	Defined by GeminiDB Mongo.	No	No	GEMINIDB_MONGODB_AUDIT
   CloudTable Doris audit logs	Defined by CloudTable Doris.	No	No	CLOUD_TABLE_DORIS
   CoreDNS logs	Defined by CoreDNS.	No	No	COREDNS_LOG
   TaurusDB audit logs	Defined by TaurusDB.	No	No	TAURUS_DB_AUDIT
   Workspace user operation logs	Defined by Workspace.	No	No	WKS_USER_EVENT
   DNS resolution request logs	Defined by DNS.	No	No	DNS_QUERY_LOG
   OBS bucket logs	Defined by OBS.	No	No	OBS_BUCKET_LOG
   StarRocks audit logs	Defined by StarRocks.	No	No	STARROCKS_AUDIT_LOG
   OBS access logs	Defined by OBS.	No	No	OBS_ACCESS_LOG

7. Click Save.

Custom Templates