Global settings

Parameter	Type	Required	Default value	Example	Description
TopicType	string	No	Empty	filepath	The type of the topic. Valid values: filepath: The information that is extracted from the log file path is used as the topic of the collected logs. This parameter takes effect only when the value of Type provided in the "Plug-in for collecting text logs" section is set to input_file. machine_group_topic: The topic of the machine group to which the configuration is applied is used as the topic of the collected logs. custom: You can specify a custom topic for the collected logs. For more information, see Log topics.
TopicFormat	string	No (This parameter is required if you set TopicType to filepath or custom.)	/	/var/log/(.*).log	The format of the topic.
EnableTimestampNanosecond	bool	No	false	false	Specifies whether to extract timestamps that are accurate to the nanosecond.

Input plug-ins

Plug-in for collecting text logs

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	input_file	The type of the plug-in. Set the value to input_file.
FilePaths	[string]	Yes	/	["/var/log/*.log"]	The paths to the files from which you want to collect logs. You can specify only one path. You can use wildcard characters (* and **) to specify a log file path. You can use the wildcard character (**) only once in a path, and you must place it before the file name.
MaxDirSearchDepth	uint	No	0	0	The number of levels of subdirectories that can be matched for the wildcard character (**) in the log file path. This parameter takes effect only when the wildcard character (**) exists in the log file path. Valid values: 0 to 1000.
ExcludeFilePaths	[string]	No	Empty	["/home/admin/*.log"]	The blacklist of file paths. A path must be an absolute path. You can use the wildcard character (*).
ExcludeFiles	[string]	No	Empty	["app*.log", "password"]	The blacklist of file names. You can use the wildcard character (*).
ExcludeDirs	[string]	No	Empty	["/home/admin/dir1", "/home/admin/dir2*"]	The blacklist of directories. A directory must be an absolute path. You can use the wildcard character (*).
FileEncoding	string	No	utf8	utf8	The encoding format of the files. Valid values: utf8 and gbk.
TailSizeKB	uint	No	1024	1024	The size of data that Logtail can collect from a log file the first time Logtail collects logs from the file. If the file size is less than this value, Logtail collects data from the beginning of the file. Valid values: 0 to 10485760. Unit: KB.
Multiline	object	No	Empty	/	The multi-line aggregation options.
Multiline.Mode	string	No	custom	custom	The multi-line aggregation mode. Valid values: custom and JSON.
Multiline.StartPattern	string	This parameter is required if you set Multiline.Mode to custom.	Empty	\d+-\d+-\d+.*	The regular expression that is used to match the beginning of the first line of a log.
EnableContainerDiscovery	bool	No	false	true	Specifies whether to enable the container discovery feature. This parameter takes effect only when Logtail runs in DaemonSet mode and the log file path is an in-container path.
ContainerFilters	object	No	Empty	/	The container filter options. Multiple options are evaluated by using a logical AND. This parameter takes effect only when EnableContainerDiscovery is set to true.
ContainerFilters.K8sNamespaceRegex	string	No	Empty	default	The namespace of the pods to which the required containers belong. The containers refer to Kubernetes containers from which you want to collect data. If you do not specify this parameter, Logtail collects data from all containers. Regular expression matching is supported.
ContainerFilters.K8sPodRegex	string	No	Empty	test-pod	The name of the pods to which the required containers belong. The containers refer to Kubernetes containers from which you want to collect data. If you do not specify this parameter, Logtail collects data from all containers. Regular expression matching is supported.
ContainerFilters.IncludeK8sLabel	map	No	Empty	/	The labels of the pods to which the required containers belong. The containers refer to Kubernetes containers from which you want to collect data. The labels are also referred to as conditions. Multiple conditions are evaluated by using a logical OR. If you do not specify this parameter, Logtail collects data from all containers. Regular expression matching is supported. To create a map, specify the name of a pod label as the key of the map, and specify the value of the pod label as the value of the map. If the value of the map is empty, the pods whose labels contain the key are matched. If the value of the map is not empty, take note of the following information: If the value starts with a caret (^) and ends with a dollar sign ($), the pods that meet the following conditions are matched: The name of a pod label contains the key of the map, and the value of the pod label matches the regular expression specified by the value of the map. In other cases, the pods whose labels exactly match the key and value of the map are matched.
ContainerFilters.ExcludeK8sLabel	map	No	Empty	/	The labels of the pods to which the required containers do not belong. The containers refer to Kubernetes containers from which you want to collect data. Multiple conditions are evaluated by using a logical OR. If you do not specify this parameter, Logtail collects data from all containers. Regular expression matching is supported. To create a map, specify the name of a pod label as the key of the map, and specify the value of the pod label as the value of the map. If the value of the map is empty, the pods whose labels contain the key are matched. If the value of the map is not empty, take note of the following information: If the value starts with a caret (^) and ends with a dollar sign ($), the pods that meet the following conditions are matched: The name of a pod label contains the key of the map, and the value of the pod label matches the regular expression specified by the value of the map. In other cases, the pods whose labels exactly match the key and value of the map are matched.
ContainerFilters.K8sContainerRegex	string	No	Empty	test-container	The name of the required containers. The containers refer to Kubernetes containers from which you want to collect data. If you do not specify this parameter, Logtail collects data from all containers. Regular expression matching is supported.
ContainerFilters.IncludeEnv	map	No	Empty	/	The environment variables of the containers from which you want to collect data. The environment variables are also referred to as conditions. Multiple conditions are evaluated by using a logical OR. If you do not specify this parameter, Logtail collects data from all containers. Regular expression matching is supported. To create a map, specify the name of an environment variable as the key of the map, and specify the value of the environment variable as the value of the map. If the value of the map is empty, the containers whose environment variables contain the key are matched. If the value of the map is not empty, take note of the following information: If the value starts with a caret (^) and ends with a dollar sign ($), the containers that meet the following conditions are matched: The name of an environment variable is the key of the map, and the value of the environment variable matches the regular expression specified by the value of the map. In other cases, the containers whose environment variables exactly match the key and value of the map are matched.
ContainerFilters.ExcludeEnv	map	No	Empty	/	The environment variables of the containers from which you do not want to collect data. Multiple conditions are evaluated by using a logical OR. If you do not specify this parameter, Logtail collects data from all containers. Regular expression matching is supported. To create a map, specify the name of an environment variable as the key of the map, and specify the value of the environment variable as the value of the map. If the value of the map is empty, the containers whose environment variables contain the key are matched. If the value of the map is not empty, take note of the following information: If the value starts with a caret (^) and ends with a dollar sign ($), the containers that meet the following conditions are matched: The name of an environment variable is the key of the map, and the value of the environment variable matches the regular expression specified by the value of the map. In other cases, the containers whose environment variables exactly match the key and value of the map are matched.
ContainerFilters.IncludeContainerLabel	map	No	Empty	/	The labels of the containers from which you want to collect data. Multiple conditions are evaluated by using a logical OR. If you do not specify this parameter, this parameter is left empty by default, which indicates that Logtail collects data from all containers. Regular expression matching is supported. To create a map, specify the name of a container label as the key of the map, and specify the value of the container label as the value of the map. If the value of the map is empty, the containers whose labels contain the key are matched. If the value of the map is not empty, take note of the following information: If the value starts with a caret (^) and ends with a dollar sign ($), the containers that meet the following conditions are matched: The name of a container label contains the key of the map, and the value of the container label matches the regular expression specified by the value of the map. In other cases, the containers whose labels exactly match the key and value of the map are matched.
ContainerFilters.ExcludeContainerLabel	map	No	Empty	/	The labels.of the containers from which you do not want to collect data. Multiple conditions are evaluated by using a logical OR. If you do not specify this parameter, this parameter is left empty by default, which indicates that Logtail collects data from all containers. Regular expression matching is supported. To create a map, specify the name of a container label as the key of the map, and specify the value of the container label as the value of the map. If the value of the map is empty, the containers whose labels contain the key are matched. If the value of the map is not empty, take note of the following information: If the value starts with a caret (^) and ends with a dollar sign ($), the containers that meet the following conditions are matched: The name of a container label contains the key of the map, and the value of the container label matches the regular expression specified by the value of the map. In other cases, the containers whose labels exactly match the key and value of the map are matched.
ExternalK8sLabelTag	map	No	Empty	/	The tags that you want to add to the collected logs. The tags are related to the labels of the pods to which the required containers belong. The containers refer to Kubernetes containers from which you want to collect data. To create a map, specify the name of a pod label as the key of the map, and specify the name of the required tag as the value of the map. For example, a map of app: k8s\_label\_app is created. If a pod contains the app=serviceA label, the system adds the related information to the collected logs as a tag. In this example, the __tag__:k8s_label_app: serviceA field is added to the collected logs. If a pod does not contain the app label, the __tag__:k8s_label_app:field is added.
ExternalEnvTag	map	No	Empty	/	The tags that you want to add to the collected logs. The tags are related to the environment variables of the required containers. The containers refer to Kubernetes containers from which you want to collect data. To create a map, specify the name of an environment variable as the key of the map, and specify the name of the required tag as the value of the map. For example, a map of VERSION: env\_version is created. If a container contains the VERSION=v1.0.0 environment variable, the system adds the related information to the collected logs as a tag. In this example, the __tag__:env_version: v1.0.0 field is added to the collected logs. If a container does not contain the VERSION environment variable, the __tag__:env_version:field is added.
CollectingContainersMeta	bool	No	false	true	Specifies whether to enable the container metadata preview feature.
AppendingLogPositionMeta	bool	No	false	false	Specifies whether to add the metadata of a file to a log. The log is included in the file. The metadata includes the __tag__:__inode__ field and the __file_offset__ field.
AllowingIncludedByMultiConfigs	bool	No	false	false	Specifies whether to allow Logtail to collect data from a file that is matched by a different Logtail configuration.

Plug-in for collecting MySQL data

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	service_mysql	The type of the plug-in. Set the value to service_mysql.
Address	string	No	127.0.0.1:3306	rm-*.mysql.rds.aliyuncs.com	The address of the MySQL database.
User	string	No	root	root	The username of the account that is used to log on to the MySQL database.
Password	string	No	Empty		The password of the account that is used to log on to the MySQL database. If you have high requirements for data security, we recommend that you set the username and password to xxx. After your configuration is synchronized to the Logtail server, find the two parameters in the /usr/local/ilogtail/user_log_config.json file, and change the values based on your business requirements. For more information, see Modify the Logtail configuration on the Logtail server.Note If you modify this parameter in the Simple Log Service console, the parameter setting in the Logtail configuration on the Logtail server is overwritten after the modification is synchronized to the server.
DataBase	string	No	/	project_database	The name of the MySQL database.
DialTimeOutMs	int	No	5000	5000	The timeout period for connections to the MySQL database. Unit: milliseconds.
ReadTimeOutMs	int	No	5000	5000	The timeout period for reading query results in the MySQL database. Unit: milliseconds.
StateMent	string	No	/		The SELECT statement. If you set CheckPoint to true, you must include the column specified by CheckPointColumn in a WHERE clause of the SELECT statement that you specify for StateMent. You can use question marks (?) to indicate replacement characters. If you use a question mark (?) in the SELECT statement, you must also specify CheckPointColumn. For example, if you set CheckPointColumn to id and CheckPointStart to 0, you can set StateMent to SELECT * from ... where id > ?. Each time Logtail executes the SELECT statement, the system saves the ID of the last data record as the checkpoint. The next time Logtail executes the SELECT statement, the question mark (?) specified in the SELECT statement is replaced with the ID that corresponds to the saved checkpoint
Limit	bool	No	false	true	Specifies whether to use a LIMIT clause to paginate query results. Valid values: true false (default) We recommend that you use a LIMIT clause to paginate query results. If you set Limit to true, a LIMIT clause is automatically added to the SELECT statement that you specify for StateMent when Logtail executes the SQL statement.
PageSize	int	No	/	10	The number of entries per page. This parameter is required if you set Limit to true.
MaxSyncSize	int	No	0	0	The maximum number of logs that can be synchronized at a time. Default value: 0, which indicates that no limits are imposed.
CheckPoint	bool	No	false	true	Specifies whether to use checkpoints during data collection. Valid values: true false (default) A checkpoint can be used as the start point of the next data collection. This way, incremental data is collected.
CheckPointColumn	string	No	Empty	1	The name of the checkpoint column. This parameter is required if you set CheckPoint to true. Warning Values in the checkpoint column must be incremental. Otherwise, some data may not be collected. The maximum value in the results of a query operation is used as the input for the next query operation.
CheckPointColumnType	string	No	Empty	int	The data type of the checkpoint column. Valid values: int and time. If you set this parameter to int, the values in the checkpoint column are stored as 64-bit integers. If you set this parameter to time, the values in the checkpoint column can be of the date, time, or datetime type that is supported by MySQL. This parameter is required if you set CheckPoint to true.
CheckPointStart	string	No	Empty		The initial value of the checkpoint column. This parameter is required if you set CheckPoint to true.
CheckPointSavePerPage	bool	No	true	true	Specifies whether to save checkpoints each time query results are paginated. Valid values: true (default): saves checkpoints each time query results are paginated. false: saves checkpoints each time query results are synchronized.
IntervalMs	int	No	60000	60000	The synchronization interval. Unit: milliseconds. Default value: 60000.

Plug-in for collecting HTTP data

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	metric_http	The type of the plug-in. Set the value to metric_http.
Address	string	Yes	/		The URLs. Important A URL must start with http or https.
IntervalMs	int	Yes	/	10	The interval between two consecutive requests. Unit: milliseconds.
Method	string	No	GET	GET	The request method. You must specify a request method in uppercase letters.
Body	string	No	Empty		The body of the HTTP request.
Headers	map	No	Empty	{"key":"value"}	The headers of the HTTP request. Example: {"key":"value"}. You can specify this parameter based on your business requirements.
PerAddressSleepMs	int	No	100	100	The interval at which requests are sent to the URLs specified by Addresses. Unit: milliseconds.
ResponseTimeoutMs	int	No	5000	5000	The timeout period for a request. Unit: milliseconds.
IncludeBody	bool	No	false	true	Specifies whether to collect the request body. Default value: false. If you set this parameter to true, the request body is stored in the field that is named content.
FollowRedirects	bool	No	false	false	Specifies whether to automatically process URL redirects.
InsecureSkipVerify	bool	No	false	false	Specifies whether to skip the HTTPS security check.
ResponseStringMatch	string	No	/		Specifies whether to match the response body against a regular expression. The match result is stored in the field that is named _response_match_. If the response body matches the regular expression, the value of the field is yes. Otherwise, the value is no.

Plug-in for collecting syslogs

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	service_syslog	The type of the plug-in. Set the value to service_syslog.
Address	string	No	tcp://127.0.0.1:9999		The listener protocol, IP address, and port of Logtail. Logtail listens to log sources and obtains logs based on your Logtail configuration. Specify a value in the [tcp/udp]://[ ip ]:[ port ] format. Default value: tcp://127.0.0.1:9999, which indicates that Logtail receives only logs that are forwarded to the Logtail server. Note The listener protocol, IP address, and port that you specify in your Logtail configuration must be the same as those specified in the forwarding rule that is added to the configuration file of rsyslog. If the server on which Logtail is installed uses multiple IP addresses to receive logs, set Address to 0.0.0.0, which indicates that Logtail listens to all IP addresses of the server.
ParseProtocol	string	No	Empty	rfc3164	The protocol that you want Logtail to use to parse logs. This parameter is left empty by default, which indicates that logs are not parsed. Valid values: Empty: Logtail does not parse logs. rfc3164: The RFC 3164 protocol is used to parse logs. rfc5424: The RFC 5424 protocol is used to parse logs. auto: Logtail automatically selects a protocol based on the content of logs.
IgnoreParseFailure	bool	No	true	true	Specifies whether to perform an operation on a log after the log fails to be parsed. Valid values: true and false. Default value: true, which indicates that the system does not parse the log and adds the log to the content field. If you set this parameter to false, the system discards the log after the log fails to be parsed.

Plug-in for collecting systemd journal logs

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	service_journal	The type of the plug-in. Set the value to service_journal.
JournalPaths	[string]	Yes	Empty	/var/log/journal	The path to the journal logs. We recommend that you set this parameter to the directory of the logs.
SeekPosition	string	No	tail	tail	The method for initial collection. Valid values: head and tail. head: Logtail collects all data. tail: Logtail collects only the data that is generated after your Logtail configuration is applied.
Kernel	bool	No	true	true	Specifies whether to collect kernel logs.
Units	[string]	No	Empty	""	The units whose logs you want to collect. This parameter is empty by default, which indicates that Logtail collects the logs of all units.
ParseSyslogFacility	bool	No	false	false	Specifies whether to parse the Facility field of syslogs. If you do not specify this parameter, Logtail does not parse the Facility field.
ParsePriority	bool	No	false	false	Specifies whether to parse the Priority field. If you do not specify this parameter, Logtail does not parse the Priority field. If you set this parameter to true, Logtail parses the Priority field. The following list describes the mapping relationships for the field: plaintext "0": "emergency" "1": "alert" "2": "critical" "3": "error" "4": "warning" "5": "notice" "6": "informational" "7": "debug"
UseJournalEventTime	bool	No	false	false	Specifies whether to use a field in journal logs as the log time. If you do not specify this parameter, the system uses the collection time as the log time. In real-time log collection scenarios, the difference between the log generation time and the log collection time is less than 3 seconds.

Plug-in for collecting SQL Server data

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	service_mssql	The type of the plug-in. Set the value to service_mssql.
Address	string	No	127.0.0.1:1433	rm-*.sqlserver.rds.aliyuncs.com	The address of the SQL Server database.
User	string	No	root	root	The username of the account that is used to log on to the SQL Server database.
Password	string	No	Empty		The password of the account that is used to log on to the SQL Server database. If you have high requirements for data security, we recommend that you set the username and password to xxx. After your configuration is synchronized to the Logtail server, find the two parameters in the /usr/local/ilogtail/user_log_config.json file, and change the values based on your business requirements. For more information, see Modify the Logtail configuration on the Logtail server.Note If you modify this parameter in the Simple Log Service console, the parameter setting in the Logtail configuration on the Logtail server is overwritten after the modification is synchronized to the server.
DataBase	string	No	/	project_database	The name of the SQL Server database.
DialTimeOutMs	int	No	5000	5000	The timeout period for connections to the SQL Server database. Unit: milliseconds.
ReadTimeOutMs	int	No	5000	5000	The timeout period for reading query results in the SQL Server database. Unit: milliseconds.
StateMent	string	No	/		The SELECT statement. If you set CheckPoint to true, you must include the column specified by CheckPointColumn in a WHERE clause of the SELECT statement that you specify for StateMent. You can use question marks (?) to indicate replacement characters. If you use a question mark (?) in the SELECT statement, you must also specify CheckPointColumn. For example, if you set CheckPointColumn to id and CheckPointStart to 0, you can set StateMent to SELECT * from ... where id > ?. Each time Logtail executes the SELECT statement, the system saves the ID of the last data record as the checkpoint. The next time Logtail executes the SELECT statement, the question mark (?) specified in the SELECT statement is replaced with the ID that corresponds to the saved checkpoint.
Limit	bool	No	false	true	Specifies whether to use a LIMIT clause to paginate query results. Valid values: true false (default) We recommend that you use a LIMIT clause to paginate query results. If you set Limit to true, a LIMIT clause is automatically added to the SELECT statement that you specify for StateMent when Logtail executes the SQL statement.
PageSize	int	No	/	10	The number of entries per page. This parameter is required if you set Limit to true.
MaxSyncSize	int	No	0	0	The maximum number of logs that can be synchronized at a time. Default value: 0, which indicates that no limits are imposed.
CheckPoint	bool	No	false	true	Specifies whether to use checkpoints during data collection. Valid values: true false (default) A checkpoint can be used as the start point of the next data collection. This way, incremental data is collected.
CheckPointColumn	string	No	Empty	1	The name of the checkpoint column. This parameter is required if you set CheckPoint to true. Warning Values in the checkpoint column must be incremental. Otherwise, some data may not be collected. The maximum value in the results of a query operation is used as the input for the next query operation.
CheckPointColumnType	string	No	Empty	int	The data type of the checkpoint column. Valid values: int and time. If you set this parameter to int, the values in the checkpoint column are stored as 64-bit integers. If you set this parameter to time, the values in the checkpoint column can be of the date, time, or datetime type that is supported by SQL Server. This parameter is required if you set CheckPoint to true.
CheckPointStart	string	No	Empty		The initial value of the checkpoint column. This parameter is required if you set CheckPoint to true.
CheckPointSavePerPage	bool	No	true	true	Specifies whether to save checkpoints each time query results are paginated. Valid values: true (default): saves checkpoints each time query results are paginated. false: saves checkpoints each time query results are synchronized.
IntervalMs	int	No	60000	60000	The synchronization interval. Unit: milliseconds. Default value: 60000.

Plug-in for collecting PostgreSQL data

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	service_pgsql	The type of the plug-in. Set the value to service_pgsql.
Address	string	No	127.0.0.1:5432	rm-*.pg.rds.aliyuncs.com	The address of the PostgreSQL database.
User	string	No	root	root	The username of the account that is used to log on to the PostgreSQL database.
Password	string	No	Empty		The password of the account that is used to log on to the PostgreSQL database. If you have high requirements for data security, we recommend that you set the username and password to xxx. After your configuration is synchronized to the Logtail server, find the two parameters in the /usr/local/ilogtail/user_log_config.json file, and change the values based on your business requirements. For more information, see Modify the Logtail configuration on the Logtail server.Note If you modify this parameter in the Simple Log Service console, the parameter setting in the Logtail configuration on the Logtail server is overwritten after the modification is synchronized to the server.
DataBase	string	No	/	project_database	The name of the PostgreSQL database.
DialTimeOutMs	int	No	5000	5000	The timeout period for connections to the PostgreSQL database. Unit: milliseconds.
ReadTimeOutMs	int	No	5000	5000	The timeout period for reading query results in the PostgreSQL database. Unit: milliseconds.
StateMent	string	No	/		The SELECT statement. If you set CheckPoint to true, you must include the column specified by CheckPointColumn in a WHERE clause of the SELECT statement that you specify for StateMent and set the value for the column to $1. For example, if you set CheckPointColumn to id, you can set StateMent to SELECT * from ... where id > $1.
Limit	bool	No	false	true	Specifies whether to use a LIMIT clause to paginate query results. Valid values: true false (default) We recommend that you use a LIMIT clause to paginate query results. If you set Limit to true, a LIMIT clause is automatically added to the SELECT statement that you specify for StateMent when Logtail executes the SQL statement.
PageSize	int	No	/	10	The number of entries per page. This parameter is required if you set Limit to true.
MaxSyncSize	int	No	0	0	The maximum number of logs that can be synchronized at a time. Default value: 0, which indicates that no limits are imposed.
CheckPoint	bool	No	false	true	Specifies whether to use checkpoints during data collection. Valid values: true false (default) A checkpoint can be used as the start point of the next data collection. This way, incremental data is collected.
CheckPointColumn	string	No	Empty	1	The name of the checkpoint column. This parameter is required if you set CheckPoint to true. Warning Values in the checkpoint column must be incremental. Otherwise, some data may not be collected. The maximum value in the results of a query operation is used as the input for the next query operation.
CheckPointColumnType	string	No	Empty	int	The data type of the checkpoint column. Valid values: int and time. If you set this parameter to int, the values in the checkpoint column are stored as 64-bit integers. If you set this parameter to time, the values in the checkpoint column can be of the time type that is supported by PostgreSQL. This parameter is required if you set CheckPoint to true.
CheckPointStart	string	No	Empty		The initial value of the checkpoint column. This parameter is required if you set CheckPoint to true.
CheckPointSavePerPage	bool	No	true	true	Specifies whether to save checkpoints each time query results are paginated. Valid values: true (default): saves checkpoints each time query results are paginated. false: saves checkpoints each time query results are synchronized.
IntervalMs	int	No	60000	60000	The synchronization interval. Unit: milliseconds. Default value: 60000.

Plug-in for collecting SNMP protocol data

Parameter	Type	Required	Default value	Example	Description
Targets	[string]	Yes	/	127.0.0.1	The IP address of the machine group.
Port	string	No	161	161	The port for the Simple Network Management Protocol (SNMP) protocol.
Community	string	No	public	public	The name of the community. SNMPv1 and SNMPv2 allow you to use the community name for authentication.
UserName	string	No	Empty	root	The username. SNMPv3 allows you to use the username for authentication.
AuthenticationProtocol	string	No	NoAuth	NoAuth	The authentication protocol. SNMPv3 allows you to use the authentication protocol for authentication.
AuthenticationPassphrase	string	No	Empty		The password for the authentication protocol. This parameter is empty by default. This parameter is required if you set AuthenticationProtocol to MD5 or SHA.
PrivacyProtocol	string	No	NoPriv	NoPriv	The privacy protocol. SNMPv3 allows you to use the privacy protocol for authentication.
PrivacyPassphrase	string	No	Empty		The password for the privacy protocol. By default, the value of this parameter is the same as the password for the authentication protocol. This parameter is required if you set PrivacyProtocol to DES or AES.
Timeout	int	No	5	5	The timeout period of the query operation. Unit: seconds.
Version	int	No	2	2	The version of the SNMP protocol. Valid values: 1, 2, and 3.
Transport	string	No	udp	udp	The method of SNMP communication. Valid values: udp and tcp.
MaxRepetitions	int	No	0	0	The number of retries allowed after the query operation times out.
Oids	[string]	No	Empty	1	The object identifier that is obtained from the required server.
Fields	[string]	No	Empty	int	The fields that you want to query on the required server. The plug-in looks up the local management information base, translates the fields into object identifiers, and then uses the object identifiers to perform the query operation.
Tables	[string]	No	Empty		The tables that you want to query on the required server. The plug-in queries all the fields in the tables, looks up the local management information base, translates the fields into object identifiers, and then uses the object identifiers to perform the query operation.

Plug-in for collecting script execution logs

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	input_command	The type of the plug-in. Set the value to input_command.
ScriptType	string	Yes	Empty	shell	The type of the script. Valid values: bash, shell, python2, and python3.
User	string	Yes	/	public	The name of the user that is used to execute the script. Only non-root users are supported. Note Make sure that the specified user name exists on the server. We recommend that you grant the user only the rwx permissions on the required directories or files.
ScriptContent	string	Yes	Empty		The content of the script. The content can be Base64-encoded or plaintext. The content must be no more than 524,288 bytes in length.
ContentEncoding	string	No	PlainText	PlainText	The text format of the script content. Valid values: PlainText (default) Base64
LineSplitSep	string	No	Empty		The delimiter that is used to separate the output of the script. If you leave this parameter empty, the output of the script is returned as a single data record.
CmdPath	string	No	Empty	/usr/bin/bash	The execution path of the script. If you leave this parameter empty, the default path is used. Default paths: bash: /usr/bin/bash shell: /usr/bin/sh python2: /usr/bin/python2 python3: /usr/bin/python3
TimeoutMilliSeconds	int	No	3000	3000	The timeout period for script execution. Unit: milliseconds.
IgnoreError	bool	No	false	false	Specifies whether to ignore error logs that are generated when Logtail fails to execute the script. Default value: false.
Environments	[string]	No			The environment variable. By default, the value returned by the os.Environ() function is used. If you specify this parameter, the value of this parameter is appended to the value returned by the os.Environ() function.
IntervalMs	int	No	5000	5000	The intervals at which logs are collected or the script is executed. Unit: milliseconds.

Processing plug-ins

Native plug-ins for data processing

Data Parsing (Regex Mode) plug-in

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	processor_parse_regex_native	The type of the plug-in. Set the value to processor_parse_regex_native.
SourceKey	string	Yes	/	content	The name of the original field.
Regex	string	Yes	/	(\d+-\d+-\d+)\s+(.*)	The regular expression.
Keys	[string]	Yes	/	["time", "msg"]	The fields that you want to extract.
KeepingSourceWhenParseFail	bool	No	false	false	Specifies whether to retain the original field if the parsing fails.
KeepingSourceWhenParseSucceed	bool	No	false	false	Specifies whether to retain the original field if the parsing succeeds.
RenamedSourceKey	string	No	Empty	key	The name of the field that is used to store the original field when the original field is retained. If you do not specify this parameter, the name of the original field is used.

Data Parsing (JSON Mode) plug-in

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	processor_parse_json_native	The type of the plug-in. Set the value to processor_parse_json_native.
SourceKey	string	Yes	/	content	The name of the original field.
KeepingSourceWhenParseFail	bool	No	false	false	Specifies whether to retain the original field if the parsing fails.
KeepingSourceWhenParseSucceed	bool	No	false	false	Specifies whether to retain the original field if the parsing succeeds.
RenamedSourceKey	string	No	Empty	key	The name of the field that is used to store the original field when the original field is retained. If you do not specify this parameter, the name of the original field is used.

Data Parsing (Delimiter Mode) plug-in

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	processor_parse_delimiter_native	The type of the plug-in. Set the value to processor_parse_delimiter_native.
SourceKey	string	Yes	/	content	The name of the original field.
Separator	string	Yes	/	,	The delimiter.
Quote	string	No	"	"	The quote.
Keys	[string]	Yes	/	["time", "msg"]	The fields that you want to extract.
AllowingShortenedFields	bool	No	true	true	Specifies whether to upload logs whose extracted fields are less than the fields specified in Keys. If you set this parameter to false, the system considers that the parsing fails.
OverflowedFieldsTreatment	string	No	extend	extend	The method that is used to process logs whose extracted fields are greater than the fields specified in Keys. Valid values: extend: retains excess fields and adds each excess field as a separate field to the collected log in the column$i format, where $i represents the sequence number of an excess field. The sequence number starts from 0. keep: retains excess fields and adds the excess fields as a whole field to the collected log in the column0_ format. discard: discards excess fields.
KeepingSourceWhenParseFail	bool	No	false	false	Specifies whether to retain the original field if the parsing fails.
KeepingSourceWhenParseSucceed	bool	No	false	false	Specifies whether to retain the original field if the parsing succeeds.
RenamedSourceKey	string	No	Empty	key	The name of the field that is used to store the original field when the original field is retained. If you do not specify this parameter, the name of the original field is used.

Data Parsing (Apache Mode) plug-in

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	processor_parse_apsara_native	The type of the plug-in. Set the value to processor_parse_apsara_native.
SourceKey	string	Yes	/	content	The name of the original field.
Timezone	string	No	Empty	GMT+08:00	The time zone of the log time. Format: GMT+HH:MM or GMT-HH:MM.
KeepingSourceWhenParseFail	bool	No	false	false	Specifies whether to retain the original field if the parsing fails.
KeepingSourceWhenParseSucceed	bool	No	false	false	Specifies whether to retain the original field if the parsing succeeds.
RenamedSourceKey	string	No	Empty	key	The name of the field that is used to store the original field when the original field is retained. If you do not specify this parameter, the name of the original field is used.

Time Parsing plug-in

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	processor_parse_timestamp_native	The type of the plug-in. Set the value to processor_parse_timestamp_native.
SourceKey	string	Yes	/	content	The name of the original field.
SourceFormat	string	Yes	/	%Y/%m/%d %H:%M:%S	The format of the log time. For more information, see Time formats.
SourceTimezone	string	No	Empty	GMT+08:00	The time zone of the log time. Format: GMT+HH:MM or GMT-HH:MM.

Data Filtering plug-in

Parameter	Type	Required	Example	Default value	Description
Type	string	Yes	processor_filter_regex_native	/	The type of the plug-in. Set the value to processor_filter_regex_native.
Include	map	Yes	/	/	The whitelist of log fields. To create a map, specify the name of a field as the key of the map, and specify a regular expression as the value of the map. The regular expression specifies the conditions that are used to match the content of the field. A log is collected only if the field in the log matches the conditions. Multiple conditions are evaluated by using a logical AND. A log is collected only if all conditions are met.

Data Masking plug-in

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	processor_desensitize_native	The type of the plug-in. Set the value to processor_desensitize_native.
SourceKey	string	Yes	/	content	The name of the original field.
Method	string	Yes	/	const	The method that is used to mask sensitive content. Valid values: const and md5. If you set this parameter to const, the system replaces the sensitive content with constants. If you set this parameter to md5, the system replaces the sensitive content with the MD5 value of the sensitive content.
ReplacingString	string	No (This parameter is required if you set Method to const.)	/	******	The constant string that is used to replace the sensitive content.
ContentPatternBeforeReplacedString	string	Yes	/	'password:'	The regular expression that is used to match the prefix of the sensitive content.
ReplacedContentPattern	string	Yes	/	[^']*	The regular expression that is used to match the sensitive content.
ReplacingAll	bool	No	true	true	Specifies whether to replace all sensitive content that is matched.

Output plug-in

Simple Log Service output plug-in

Parameter	Type	Required	Default value	Example	Description
Type	string	Yes	/	flusher_sls	The type of the plug-in. Set the value to flusher_sls.
Logstore	stirng	Yes	/	test-logstore	The name of the Logstore.