Kubernetes Ingress log center

The Ingress log center automatically aggregates real-time access logs and provides intelligent inspection, real-time alerts, and other features, detailed as follows:

• Collection, storage, query, and analysis of real-time access logs.

• Real-time extraction of various metrics from raw access logs, including page views (PV), request success rate, average latency, P50/P99/P9999 latency, and inbound and outbound traffic. It supports multiple dimension combinations, including host and status.

• Rich visualization reports, including dashboards, anomalous activities, and operation dashboards. It supports report email and DingTalk group subscriptions.

• Provides intelligent inspection features, supporting global and service-level inspections, and directly marking abnormal points in visualization reports.

• Custom alert configuration. Alert notifications directly connect to the message center, email, and DingTalk, and support custom WebHook integration.

The assets in your project are as follows:

• Logstore

  • The logstore used to store the access logs of Kubernetes Ingress. This logstore is a custom-created logstore.

    • The indexing feature is automatically enabled for the logstore, and indexes are automatically configured for specific fields. You can add index fields. Modifications to the index only take effect on new data. You can also reindex historical data. For more information, see Reindex logs for a logstore.

    • You can modify the log storage time (Data Retention Period). For more information, see Manage a logstore.

  • The logstore used to store the inspection results. After the Ingress log center feature is enabled, this dedicated logstore is automatically generated. Its name is Logstore for access logs-metrics-result.

  Important

  • Do not delete the logstore used to store the access logs of Kubernetes Ingress. Otherwise, logs cannot be collected into Simple Log Service properly.

  • Do not delete the indexes of specific fields in the logstore that is used to store access logs. If you delete the indexes, metric conversion fails.

• Metricstore

  The metricstore that is used to store aggregated data about the collected metrics. After the Ingress log center feature is enabled, this dedicated metricstore is automatically generated. Its name is Logstore for access logs-metrics.

  Note

  The metricstore stores aggregated metrics. The data volume is greatly reduced compared to raw access logs, making it very suitable for long-term storage.

• Aggregation rules

  Rule name	Time granularity	Aggregation dimension	Generated metrics

  Rule name	Time granularity	Aggregation dimension	Generated metrics
  total	10 seconds	total	pv body_bytes_sent_avg body_bytes_sent_sum request_length_avg request_length_sum upstream_response_time_avg upstream_response_time_p50 upstream_response_time_p90 upstream_response_time_p99 upstream_response_time_p9999 request_time_avg request_time_p50 request_time_p90 request_time_p99 request_time_p9999
  host	10 seconds	host	pv:host body_bytes_sent_avg:host body_bytes_sent_sum:host request_length_avg:host request_length_sum:host upstream_response_time_avg:host upstream_response_time_p50:host upstream_response_time_p90:host upstream_response_time_p99:host upstream_response_time_p9999:host request_time_avg:host request_time_p50:host request_time_p90:host request_time_p99:host request_time_p9999:host
  host_status	10 seconds	host+status	pv:host:status body_bytes_sent_avg:host:status body_bytes_sent_sum:host:status request_length_avg:host:status request_length_sum:host:status upstream_response_time_avg:host:status upstream_response_time_p50:host:status upstream_response_time_p90:host:status upstream_response_time_p99:host:status upstream_response_time_p9999:host:status request_time_avg:host:status request_time_p50:host:status request_time_p90:host:status request_time_p99:host:status request_time_p9999:host:status

• Inspection rules

  Rule name	Status	Inspection algorithm	Inspection metrics

  Rule name	Status	Inspection algorithm	Inspection metrics
  total	Enabled by default	Time2Graph	pv body_bytes_sent_avg body_bytes_sent_sum request_length_avg request_length_sum upstream_response_time_avg request_time_avg
  host	Enabled by default	Time2Graph	pv:host body_bytes_sent_avg:host body_bytes_sent_sum:host request_length_avg:host request_length_sum:host upstream_response_time_avg:host request_time_avg:host
  host_status	Disabled by default	Time2Graph	pv:host:status body_bytes_sent_avg:host:status body_bytes_sent_sum:host:status request_length_avg:host:status request_length_sum:host:status upstream_response_time_avg:host:status request_time_avg:host:status

• Dedicated dashboards

  Dashboard	Associated logstore or metricstore	Description

  Dashboard	Associated logstore or metricstore	Description
  Operations dashboard	Logstore for access logs	Displays information related to user requests, including PV, UV, mobile distribution, and country/province/city distribution. Note This information is calculated based on the full amount of raw access logs. There may be some delay when the data volume is extremely large.
  Overview	Logstore for access logs-metrics	Displays overall monitoring information of Kubernetes, including PV, failure rate, 5XX ratio, status code distribution, and traffic.
  Monitoring dashboard	Logstore for access logs-metrics	Supports filtering detailed monitoring information of instances by dimensions such as host and status.
  Exceptions	Logstore for access logs-metrics Logstore for access logs-metrics-result	Displays service-level anomalous information detected by the stream inspection algorithm, including anomaly statistics and real-time display of specific metrics anomalies.