Ingesting CFW Logs to LTS

Configuring CFW Log Ingestion to LTS

1. Log in to the LTS console.
2. Choose Log Ingestion > Ingestion Center in the navigation pane and click CFW (Cloud Firewall).
3. Select a log stream.
   1. Select a log group from the Log Group drop-down list. If there are no desired log groups, click Create Log Group to create one.
   2. Select a log stream from the Log Stream drop-down list under Record Attack Log. If there are no desired log streams, click Create Log Stream to create one.
   3. Select a log stream from the Log Stream drop-down list under Record Access Log. If there are no desired log streams, click Create Log Stream to create one.
   4. Select a log stream from the Log Stream drop-down list under Record Traffic Log. If there are no desired log streams, click Create Log Stream to create one.
   5. Click Next: Configure CFW. For details, see Configuring Logs.

4. Click Configure CFW.
5. Click Next: Configure Log Stream.

   Table 1 Log stream parameters

   Parameter	Description
   Auto Structure and Index	If this function is enabled, the structuring for the log stream is based on the CFW system template, and the indexing enables quick analysis for all parsed CFW fields. Enabling structuring and indexing is required for SQL analysis of CFW logs with visual charts.
   Auto Add Tag log_type=cfw_attack, log_type=cfw_access, log_type=cfw_flow	If this option is enabled, tags log_type=cfw_attack, log_type=cfw_access, and log_type=cfw_flow are automatically added to the log stream, and the CFW dashboard template can then match this log stream.
   Auto Create Dashboard	If this option is enabled, a CFW dashboard is automatically created for the log stream.

6. Click Submit.