Cross-Workspace Index Query¶

Introduction¶

Guance uses collectors to report log data to workspaces, and enables viewing, searching, and analyzing log data in the Log Explorer. At the same time, Guance provides index functionality to define classification rules for log data, allowing users to save and access logs through different indexes and configure data storage policies as needed to effectively control storage costs.

Both logs and indexes have the attribute of workspace ownership:

• Logs are stored in a workspace;
• Indexes are classification and storage rules created for the log data in that workspace.

Enterprises often create multiple workspaces for data management due to needs such as cost calculation or permission control. Although this model enables data management by department, it is not conducive to global data analysis. To meet the need for global data analysis under segmented data management, Guance provides the cross-workspace query feature to obtain log data from other workspaces.

Specifically, since logs are classified by index, after the index data of "Workspace 1" is authorized to "Workspace 2", you can obtain the indexes of "Workspace 1" in the Log Explorer of "Workspace 2" and view the log data under the corresponding indexes. This feature breaks through the limitations of log data storage location and greatly improves the efficiency of data analysis and fault localization.

Procedure¶

Example Scenario¶

If the index data of "Workspace 1" is authorized to "Workspace 2", for "Workspace 2", the indexes available are divided into two types:

• Indexes originally in the current workspace;

• Indexes authorized by other workspaces.

Query Original Indexes of the Current Workspace¶

Enter the Log Explorer of "Workspace 2". The "Workspace bar" at the top-left defaults to the current workspace.

The Quick Filter on the left lists all available indexes in the current workspace: Default Index, Log Index, and External Index.

Query Indexes Authorized by Other Workspaces¶

If "Workspace 2" needs to access the index data of "Workspace 1", cross-workspace index authorization requires two steps:

1. In the workspace where authorization needs to be performed (Workspace 1), authorize the corresponding log items and indexes;

2. Enter the authorized workspace (Workspace 2) and select index items for application.

For operation details, refer to Cross-Workspace Authorization.

Once the above two steps are completed, the index authorization from "Workspace 1" to "Workspace 2" is done. Now enter the authorized workspace — "Workspace 2" > Log Explorer.

Select Workspace¶

Click the Workspace drop-down to view all selectable workspaces. Single or multiple selection is supported here.

Select Index¶

After selecting a workspace, the indexes of that workspace are listed synchronously in the Quick Filter:

Analyze Log Data¶

Cross-workspace index query only affects the channel for obtaining log data, and other log analysis features are not affected.

After selecting workspaces and indexes in the Log Explorer, you can use the original features of the Log Explorer normally, such as search, quick filtering, status chart display, and analysis.

Delete an Index¶

To delete the index whytest under Workspace 1 that has been authorized to other workspaces for querying, click Delete, enter the index name whytest in the confirmation dialog, and then click OK to complete the deletion.

Once deletion is confirmed, this change will immediately affect "Workspace 2", and the corresponding index will become unavailable.