Querying a Structuring Template

project_id

Yes

String

Project ID. For details about how to obtain a project ID, see Obtaining the Project ID, Account ID, Log Group ID, and Log Stream ID.

Minimum: 32

Maximum: 32

id

No

String

ID of the template to be queried. This parameter is optional. If this parameter is not specified, all custom structuring templates used in the project are returned.

Minimum: 36

Maximum: 36

X-Auth-Token

Yes

String

User token obtained from IAM. For details about how to obtain a user token, see Obtaining a User Token.

Minimum: 1000

Maximum: 2000

Content-Type

Yes

String

Set this parameter to application/json;charset=UTF-8.

Minimum: 30

Maximum: 30

results

Array of StructTemplateModel objects

Array of queried customized structuring templates.

project_id

String

Project ID.

Minimum: 32

Maximum: 32

template_name

String

Template name.

Minimum: 1

Maximum: 64

template_type

String

Template type. The options are regular expression, JSON, delimiter, and Nginx.

demo_log

String

Sample log event.

Minimum: 1

Maximum: 5000

demo_fields

Array of DemoField objects

Example field array.

tag_fields

Array of TagFieldNew objects

Tag field array.

rule

TemplateRule object

Structuring rule object.

demo_label

String

Example log tag.

Minimum: 0

Maximum: 5000

create_time

Long

Creation time.

Minimum: 0

Maximum: 20000000000000

id

String

Template ID.

Minimum: 36

Maximum: 36

field_name

String

Field name.

Minimum: 1

Maximum: 64

content

String

Field example.

Minimum: 1

Maximum: 5000

type

String

Field data type.

Value: string, long, or float

is_analysis

Boolean

Whether to enable quick analysis.

index

Integer

Field number in manual regular expression and delimiter modes.

Minimum: 0

Maximum: 200

relation

String

Describes the hierarchical relationship between fields in a multi-level JSON file.

Minimum: 0

Maximum: 1000

user_defined_name

String

Custom field alias in JSON and Nginx modes.

Minimum: 1

Maximum: 64

field_name

String

Field name.

Minimum: 1

Maximum: 64

content

String

Field example.

Minimum: 0

Maximum: 5000

type

String

Field data type.

Value: string, long, or float

is_analysis

Boolean

Whether to enable quick analysis.

index

Integer

Sequence number (starting from 0).

Minimum: 0

Maximum: 200

type

String

Structuring type. Currently, regular expression, JSON, delimiters, and Nginx are supported.

param

String

Specific structuring rule. Each structuring type has a unique structure:

A manual regular expression is a JSON string that contains the keyObject and regex_rules objects. keyObject contains key-value pairs, where a key indicates the index of an element in the demo_fields array, and a value indicates field_name. regex_rules is a regular expression. Example:

{\"keyObject\":{\"1\":\"date\",\"2\":\"num\"},\"regex_rules\":\"^(?<date>[^/]+)(?:[^]* ){8}(?<num>\\\\d+)\"}

In JSON mode, param is a JSON string that contains the keyObject and layers objects. keyObject contains key-value pairs, where a key indicates the field_name of an element in the demo_fields array, and a value indicates user_defined_name. layers indicates the maximum number of parsing layers. Its maximum value is 4. Example:

{\"keyObject\":{\"metadata.dimension\":\"dimension\",\"metadata.value\":\"\",\"metadata.unit\":\"\",\"collectionTime\":\"\"},\"layers\":3}

The delimiter mode uses a JSON string that contains the keyObject and tokenizer objects. keyObject contains key-value pairs, where a key indicates the index of an element in the demo_fields array, and a value indicates field_name. tokenizer indicates delimiters. Example:

{\"keyObject\":{\"0\":\"field1\",\"1\":\"field2\",\"2\":\"field3\",\"3\":\"field4\",\"4\":\"field5\",\"5\":\"field6\",\"6\":\"field7\",\"7\":\"field8\",\"8\":\"field9\"},\"tokenizer\":\"\"}

The Nginx mode uses a JSON string that contains the keyObject, regex, field_names, and log_format objects. keyObject contains key-value pairs, where a key indicates the field_name of an element in the demo_fields array, and a value indicates user_defined_name. regex is a regular expression, where the field_names object is the combination of field_name of each element in the demo_fields array. field_names are separated by commas (,). The log_format object indicates the Nginx log formatting mode. Example:

{\"keyObject\":{\"http_host\":\"host\",\"remote_addr\":\"\",\"request_method\":\"\",\"request_uri\":\"\",\"time_local\":\"\"},\"regex\":\"(\\\\d+/\\\\S+/\\\\d+:\\\\d+:\\\\d+:\\\\d+)\\\\s+\\\\S+\\\\s+(\\\\S*)\\\\s+(\\\\S*)\\\\s+(\\\\S*)\\\\s+\\\"([^\\\"]*)\\\".*\",\"fieldNames\":\"time_local,remote_addr,request_method,http_host,request_uri\",\"log_format\":\"log_format
upstreaminfo '$time_local $remote_addr  $request_method $http_host
\\\"$request_uri\\\"';\"}

Minimum: 1

Maximum: 5000

error_code

String

Error code.

Minimum: 8

Maximum: 8

error_msg

String

Error message.

200

The request is successful.

500

The server has received the request but encountered an internal error.