Index¶

By extracting key characteristics such as log fields and metric tags, indexes correlate characteristic values with raw data, enabling efficient retrieval and avoiding inefficient full scans.

After you create and manage multiple indexes, the system automatically archives log data to the corresponding indexes based on preset filter conditions. You can also customize the data storage policy for each index to effectively control and reduce storage costs, balancing data management flexibility with cost efficiency.

Create¶

Guance supports creating or binding three types of indexes:

When data is collected into Guance, the system splits and distributes it to indexes or forwards it to other third-party systems according to rules, improving data processing efficiency and meeting the need for multi-path data distribution.

Manage¶

You can manage the index list through the following operations.

Export Indexes¶

In the corresponding index type list, click the "Export" button in the upper-right corner to export the JSON file of the corresponding index.

Import Indexes¶

You can import local index configuration files.

Log Index Mapping¶

Log index mapping is used to automatically select the default log index used for related queries on the detail page, based on the field values in the detail data.

Configuration Entry¶

Go to Logs > Indexes and click Log Index Mapping to create and manage the mapping between field values and default log indexes.

Configuration Methods¶

Each mapping contains:

• Match Field: The field name in the detail data, such as app_id, source, service, env, or version;
• Field Value: The field value used to determine whether a match is hit;
• Default Log Index: The log index to query after the field value matches.

Configuration example:

To configure the original "match service" capability, set the match field to service, then enter the service name and the corresponding log index.

Related Queries¶

Once the configuration takes effect, when viewing related logs from data detail pages such as RUM and APM, the system reads the fields from the current detail data and automatically selects all matching available log indexes.

Log count statistics and log list queries use the same index match results to keep the count and the list contents consistent.

Field Value Matching¶

Field values support the following configuration methods:

• Exact match: for example, front-backend;
• Multi-value match: use English commas to separate multiple values, for example, api,web;
• Wildcard match:
  • *: Matches zero or more arbitrary characters;
  • ?: Matches a single arbitrary character.

Multiple Rule Matches¶

The system checks all mapping rules and merges all matching available log indexes:

• When the same field value matches multiple mappings, all corresponding indexes are queried;
• When exact rules and wildcard rules match at the same time, all corresponding indexes are merged;
• When multiple rules point to the same index, the system automatically deduplicates them;
• Log count statistics and log list queries use the same set of indexes.

For example:

When the current service is api-order, the system queries both application-log and order-log.

Index Status Control¶

• Disable an index: Subsequent logs no longer enter this index and continue to be matched and stored in other indexes. If no other index matches, they are stored in the default default index;
• Enable an index: Subsequent logs re-enter this index for storage.

Edit Index Configuration¶

You can edit existing log index configurations.

Delete Index¶

Click the delete icon of the index to be deleted, enter the index name in the confirmation dialog, and confirm the deletion.

Index Sorting¶

Click to enter edit mode: drag indexes up or down to adjust the order of existing log indexes. Single-select and multi-select modes are supported for cross-page sorting, and you can move one or more indexes to a specified position.

Operation Audit¶

Click the audit icon to view all operation logs for this index.