Parameter | Description |
Original Field | The original field that is used to store the content of a log before the log is parsed. Default value: content. |
Delimiter | The delimiter based on which you want to extract log fields. Select a delimiter based on the actual log content. For example, you can select Vertical Bar (|). Note If you set the Delimiter parameter to Non-printable Character, you must enter a character in the following format: 0x<Hexadecimal ASCII code of the non-printable character>. For example, if you want to use the non-printable character whose hexadecimal ASCII code is 01, you must enter 0x01. |
Quote | The quote. If a log field contains delimiters, you must specify a quote to enclose the field. Simple Log Service parses the content that is enclosed in a pair of quotes into a complete field. You must select a quote based on the format of logs that you want to collect. Note If you set the Quote parameter to Non-printable Character, you must enter a character in the following format: 0x<Hexadecimal ASCII code of the non-printable character>. For example, if you want to use the non-printable character whose hexadecimal ASCII code is 01, you must enter 0x01. |
Extracted Field | If you specify a sample log, Simple Log Service can automatically extract log content based on the specified sample log and delimiter. Configure the Key parameter for each Value parameter. The Key parameter specifies the new field name. The Value parameter specifies the content that is extracted. If you do not specify a sample log, the Value column is unavailable. You must specify keys based on the actual logs and delimiter.
A key can contain only letters, digits, and underscores (_) and must start with a letter or an underscore (_). A key can be up to 128 bytes in length. |
Allow Missing Field | Specifies whether to upload logs that contain keys whose values are empty to Simple Log Service if the number of extracted values is less than the number of specified keys. If you select the Allow Missing Fields parameter, the logs are uploaded to Simple Log Service. In this example, a log is 11|22|33|44, the Delimiter parameter is set to Vertical Bar (|), and the keys are set to A, B, C, D, and E. The value of the E field is empty. If you select the Allow Missing Field parameter, the log is uploaded to Simple Log Service. If you do not select the Allow Missing Field parameter, the log is discarded. Note Linux Logtail V1.0.28 and later or Windows Logtail V1.0.28.0 and later supports the Allow Missing Field parameter.
|
Processing Method of Field to which Excess Part is Assigned | The method that is used to process excess values that are extracted if the number of extracted values is greater than the number of specified keys. Expand: retains the excess values and adds the values to the fields in the __column$i__ format respectively. $i indicates the sequence number of the excess field. The sequence number starts from 0. Examples: __column0__ and __column1__. Retain: retains the excess values and adds the values to the __column0__ field. Drop: discards the excess values.
|
Retain Original Field if Parsing Fails | If you select the Retain Original Field if Parsing Fails parameter and parsing fails, the original field is retained. |
Retain Original Field if Parsing Succeeds | If you select the Retain Original Field if Parsing Succeeds parameter and parsing is successful, the original field is retained. |
New Name of Original Field | If you select the Retain Original Field if Parsing Fails or Retain Original Field if Parsing Succeeds parameter, you can rename the original field to store the original log content. |
Elastic Compute Service (ECS)
Container Compute Service (ACS)
