Indexes¶
By extracting key features such as log fields and metric tags, indexes can associate feature values with raw data, enabling efficient retrieval and avoiding inefficient full scans.
After creating and managing multiple indexes, the system will automatically archive log data into corresponding indexes based on preset filter conditions. At the same time, you can customize data storage policies for each index, effectively controlling and reducing storage costs, balancing data management flexibility with economic benefits.
Create¶
Guance supports creating or binding three types of indexes:
Index Type |
Definition | Core Features and Data Flow |
Control Ownership |
|---|---|---|---|
| Log Index | The basic log storage unit in Guance. After log data is reported, the system automatically sorts and stores it into matching indexes based on preset rules (such as matching conditions, filters) | Rule-based automatic sorting Collector → Guance unified reception → Sorting by rules → Writing to target index |
Guance platform console (Control is achieved by configuring index rules) |
| Direct Write Index | A write method where the collector directly specifies the target index name. Data bypasses the default sorting rules on the platform side and is written directly to the specified index | Specified target direct write Collector (specifies index name) → Directly writes to target index |
Collector configuration (Specified in the configuration of collectors such as DataKit) |
| External Index | A cross-data source query integration function provided by Guance. By binding authorization, an external data source (such as a self-built ES) is mapped to a logical index that can be uniformly queried within the workspace | External data source binding and unified query Data is stored externally, Guance establishes query channels for retrieval |
External data source system (Data ownership and storage management are external) |
When data is collected into Guance, the system will distribute it to indexes or forward it to other third-party systems based on rules, thereby improving data processing efficiency and meeting the needs of multi-path data distribution.
Manage¶
You can manage the index list through the following operations.
Export Indexes¶
In the corresponding index type list, click the "Export" button in the upper right corner to export the corresponding index JSON file.
Import Indexes¶
Supports importing local index configuration files.
Index Status Control¶
- Disable Index: Subsequent logs will no longer enter this index and will continue to match and flow into other indexes for saving. If no other index matches, they will be saved in the default
defaultindex. - Enable Index: Subsequent logs will re-enter this index for saving.
Edit Index Configuration¶
Supports editing the configuration of created log indexes.
Note
Changing the storage policy will delete data in the index. Please operate with caution.
Delete Indexes¶
Click the delete icon to delete a created index.
Note
- After deletion, log data in this index will also be deleted. If no other matching index exists, subsequently reported log data will be saved in the default index
default. - If the deleted index has been authorized for querying by other workspaces, the other spaces will no longer be able to query this index after deletion.
- After deleting a log index, you can create an index with the same name as needed.
Sort Indexes¶
Click Edit Mode: You can drag up or down to adjust the order of created log indexes; Supports single selection and multiple selection for cross-page sorting adjustments, allowing one or more indexes to be moved to a specified position.
Note
Logs will flow into the first matching index. Changing the index order may cause logs to change their flow direction.
Operation Audit¶
Click the audit icon to view all operation logs for this index.