Querying a Structuring Template

project_id

Yes

String

Project ID. For details about how to obtain a project ID, see Obtaining the Project ID, Account ID, Log Group ID, and Log Stream ID.

id

No

String

ID of the template to be queried. This parameter is optional. If this parameter is not specified, all custom structuring templates used in the project are returned.

X-Auth-Token

Yes

String

User token obtained from IAM. For details about how to obtain a user token, see Obtaining a User Token.

Content-Type

Yes

String

Set this parameter to application/json;charset=UTF-8.

results

Array of StructTemplateModel objects

Array of queried customized structuring templates.

project_id

String

Project ID.

template_name

String

Template name.

template_type

String

Template type. The options are regular expression, JSON, delimiter, and Nginx.

demo_log

String

Sample log event.

demo_fields

Array of DemoField objects

Example field array.

tag_fields

Array of TagFieldNew objects

Tag field array.

rule

TemplateRule object

Structuring rule object.

demo_label

String

Example log tag.

create_time

Long

Creation time.

id

String

Template ID.

field_name

String

Field name.

content

String

Field example.

type

String

Field data type.

Value: string, long, or float

is_analysis

Boolean

Whether to enable quick analysis.

index

Integer

Field number in manual regular expression and delimiter modes.

relation

String

Describes the hierarchical relationship between fields in a multi-level JSON file.

user_defined_name

String

Custom field alias in JSON and Nginx modes.

field_name

String

Field name.

content

String

Field example.

type

String

Field data type.

Value: string, long, or float

is_analysis

Boolean

Whether to enable quick analysis.

index

Integer

Sequence number (starting from 0).

type

String

Structuring type. Currently, regular expression, JSON, delimiters, and Nginx are supported.

param

String

Specific structuring rule. Each structuring type has a unique structure:

A manual regular expression is a JSON string that contains the keyObject and regex_rules objects. keyObject contains key-value pairs, where a key indicates the index of an element in the demo_fields array, and a value indicates field_name. regex_rules is a regular expression. Example:

{\"keyObject\":{\"1\":\"date\",\"2\":\"num\"},\"regex_rules\":\"^(?<date>[^/]+)(?:[^]* ){8}(?<num>\\\\d+)\"}

In JSON mode, param is a JSON string that contains the keyObject and layers objects. keyObject contains key-value pairs, where a key indicates the field_name of an element in the demo_fields array, and a value indicates user_defined_name. layers indicates the maximum number of parsing layers. Its maximum value is 4. Example:

{\"keyObject\":{\"metadata.dimension\":\"dimension\",\"metadata.value\":\"\",\"metadata.unit\":\"\",\"collectionTime\":\"\"},\"layers\":3}

The delimiter mode uses a JSON string that contains the keyObject and tokenizer objects. keyObject contains key-value pairs, where a key indicates the index of an element in the demo_fields array, and a value indicates field_name. tokenizer indicates delimiters. Example:

{\"keyObject\":{\"0\":\"field1\",\"1\":\"field2\",\"2\":\"field3\",\"3\":\"field4\",\"4\":\"field5\",\"5\":\"field6\",\"6\":\"field7\",\"7\":\"field8\",\"8\":\"field9\"},\"tokenizer\":\"\"}

The Nginx mode uses a JSON string that contains the keyObject, regex, field_names, and log_format objects. keyObject contains key-value pairs, where a key indicates the field_name of an element in the demo_fields array, and a value indicates user_defined_name. regex is a regular expression, where the field_names object is the combination of field_name of each element in the demo_fields array. field_names are separated by commas (,). The log_format object indicates the Nginx log formatting mode. Example:

{\"keyObject\":{\"http_host\":\"host\",\"remote_addr\":\"\",\"request_method\":\"\",\"request_uri\":\"\",\"time_local\":\"\"},\"regex\":\"(\\\\d+/\\\\S+/\\\\d+:\\\\d+:\\\\d+:\\\\d+)\\\\s+\\\\S+\\\\s+(\\\\S*)\\\\s+(\\\\S*)\\\\s+(\\\\S*)\\\\s+\\\"([^\\\"]*)\\\".*\",\"fieldNames\":\"time_local,remote_addr,request_method,http_host,request_uri\",\"log_format\":\"log_format
upstreaminfo '$time_local $remote_addr  $request_method $http_host
\\\"$request_uri\\\"';\"}

error_code

String

Error code.

error_msg

String

Error message.

200

The request is successful.

500

The server has received the request but encountered an internal error.