External Indices¶
Bind external indices on the Guance side to query and analyze external index data.
Currently supported external indices include:
Note
- Bound indices can only be deleted; after unbinding, logs under that index cannot be queried.
- Other indices cannot have the same name as log indices or historical log indices.
Field Mapping¶
Since the standard fields of the platform and external indices may not be consistent, a field mapping function is provided to ensure normal usage. When binding external indices, you can directly map log fields:
| Field | Description |
|---|---|
time |
The reporting time of the log. SLS Logstore defaults to mapping the date field to time. For Elasticsearch and OpenSearch, it can be filled according to the actual data. If this field is missing, data in the log explorer will be displayed out of order. |
_docid |
The unique ID of the log. After mapping, you can view the details of the bound log. If the original field is not unique, the earliest log by time will be displayed after refreshing the details page. If this field is missing, some content will be missing on the log details page. |
message |
The content of the log. After mapping, you can view the content of the bound log and perform cluster analysis on the log data through the message field. |
You can also click Modify in the external indices list to enter the index that needs field mapping modifications.
Note
- The mapping rules for each index are saved independently and do not interact.
- If a log has a
_docidfield and the same field is mapped, the_docidin the original log will not take effect.