Manage Forwarding Rules¶

Rule List¶

All created data forwarding rules can be viewed in the Manage > Data Forwarding > Forwarding Rules list. You can manage the list through the following operations:

Search by entering a rule name;
Enable or disable the current rule;
Click the search, edit, or delete button on the right side of the rule to perform the corresponding operation;
Select multiple rules for batch operations.

Note

There may be a delay of up to 1 hour when viewing forwarded data;
In edit mode, the access type and region cannot be adjusted; for rules selecting Guance storage, the edit and view contents are consistent.

Delete Rule¶

When deleting a rule, you need to enter the rule name to confirm the operation.

The system sets the rule status to "Deleting". After processing is complete, the rule will be automatically removed. During this process, creating a rule with the same name is not allowed.

When data is forwarded to Guance: the already forwarded data will also be permanently deleted;
When data is forwarded to external storage: the system will stop forwarding new data to this rule, and the already forwarded data will continue to be retained. If cleanup is needed, please go to the console of the corresponding storage system to perform operations.

Restore Task¶

When the storage type of the forwarded data is Archive (mainly referring to Archive Storage and Cold Archive Storage for Volcengine TOS), the data will be in a state that is not directly accessible. If querying is needed at this time, a restore operation must be performed first; after the data is thawed, it can be accessed and analyzed normally.

Create Restore Task¶

Select a time range;
Select a restore mode:
- Expedited Retrieval
- Standard Retrieval
- Bulk Retrieval
Select a validity period.

After the task is created, you can view the task restoration progress in the restore task window.

Billing Details¶

Restoring data from archive storage is expected to take some time. This process will generate two types of fees through the cloud vendor: data retrieval fees and temporary copy storage fees, both calculated based on the amount of data restored. However, Guance itself does not charge any additional fees during this process.

Data Explorer¶

On the "Data Explorer" page, you can search and query the latest data results based on the time range and forwarding rules.

You can also search for fields directly using the key:value format. The system will fetch files in batches according to the selected time to search for matching data, returning 50 entries per batch. If no data is found in the first query or fewer than 50 entries are returned, you can manually click "Continue Query" until the scan is complete.

Search Query Logic

You can use the field :~ value format for search queries, which employs regex matching logic. - The system will return all content containing the string field:value. For example, if the search condition host:~ hangzhou is entered, all data containing host: hangzhou will be returned. Exact matching is not supported. - Multiple filter conditions can be connected using AND or OR.

Data Forwarding - Query and Restore Duration¶

After configuring the query duration, when viewing forwarded data, the query time range will be affected by the duration configured here.

Go to Manage > Workspace Settings > Advanced Settings > Data Forwarding - Query and Restore Duration;
Select the duration;
Confirm.