Cross-Workspace Index Query¶

Introduction¶

Guance collects log data through collectors and uploads it uniformly to a workspace, enabling viewing, retrieval, and analysis of log data through the log explorer. Meanwhile, Guance provides indexing functionality, defining classification rules for log data, allowing users to save and access logs through different indexes, and configure data storage policies as needed to effectively control storage costs.

Both logs and indexes have the attribute of belonging to a workspace:

Logs are stored within a workspace.
Indexes are classification and storage rules created for the log data within that space.

For purposes such as cost accounting or permission control, enterprises often create multiple workspaces for data management. While this model achieves departmental data management, it is not conducive to global data analysis. To address the need for global data analysis under decentralized data management, Guance provides a cross-workspace query function, allowing access to log data from other spaces.

Specifically, since logs are categorized by index, after authorizing the index data of "Workspace 1" to "Workspace 2", you can access the indexes from "Workspace 1" within the log explorer of "Workspace 2", thereby viewing the log data under the corresponding indexes. This functionality breaks through the limitation of log data storage location, significantly improving the efficiency of data analysis and fault localization.

Steps¶

Scenario Example¶

If the index data of "Workspace 1" is authorized to "Workspace 2", for "Workspace 2", the callable indexes fall into two categories:

Original indexes of the current workspace;
Indexes authorized by other workspaces.

Query Original Indexes of This Workspace¶

Enter the log explorer of "Workspace 2". The "Workspace" dropdown in the upper-left corner defaults to the current workspace.

All available original indexes of this workspace are listed in the quick filter area on the left, which are: default index, log index, and external index.

Query Indexes Authorized by Other Workspaces¶

If "Workspace 2" needs to access the index data of "Workspace 1", cross-workspace index authorization involves two steps:

Perform the corresponding log item and index authorization in the workspace that needs to grant authorization (Workspace 1);
Enter the authorized workspace (Workspace 2) and select the index items to apply.

For specific operational details, refer to Cross-Workspace Authorization.

After completing the above two steps, meaning the index authorization from "Workspace 1" to "Workspace 2" is already in place, enter the authorized workspace---"Workspace 2" > Log Explorer.

Select Workspace¶

Click the Workspace dropdown to view all selectable workspaces. Single or multiple selections are supported here.

Note

The list of selectable workspaces here only includes workspaces that meet three conditions: belong to the same cluster; have completed the authorization operation; and the authorized data scope includes log data.
When a single space is selected, the name of the selected workspace is directly displayed in the workspace bar; when multiple workspaces are selected, it displays as: Selected n items, click to view specific options.

Select Index¶

After selecting a workspace, the indexes under that workspace are simultaneously listed in the Quick Filter area:

Note

External indexes do not support cross-workspace queries. External indexes are only available when the current workspace is selected. If other workspaces are selected, external indexes will be unavailable.
The log index defaults to default. When multiple workspaces are selected, all default indexes from the multiple spaces are grouped under the same default index.
For cross-workspace authorized indexes, only the available indexes within the authorized scope are listed synchronously.

Analyze Log Data¶

Cross-workspace index query only affects the source channel for obtaining log data; other log analysis functions are unaffected.

After selecting the workspace and index in the log explorer, you can normally use the original functions of the log explorer, such as search, quick filtering, status chart display, and analysis.

Delete Index¶

If you delete the index whytest under Workspace 1, and since this index has already been authorized to other spaces, a confirmation prompt will pop up when deleting. Click Confirm to delete the index.

Once confirmed for deletion, this change will immediately affect "Workspace 2", and the corresponding index will become unavailable.