Manage Forwarding Rules¶

Rule List¶

All created data forwarding rules can be viewed in the Manage > Data Forwarding > Forwarding Rules list. You can manage the list through the following operations:

Search by entering the rule name;
Enable or disable the current rule;
Click the search, edit, or delete button on the right side of the rule to perform the corresponding operation;
Select multiple rules for batch operations.

Note

There may be a delay of up to 1 hour when viewing forwarded data.
In edit mode, the access type and region cannot be adjusted; for rules stored in Guance, the edit and view contents are consistent.
After deleting a rule, the forwarded data will not be deleted, but no new data will be generated.

Restore Task¶

When the storage type of forwarded data is archive (mainly referring to Archive Storage and Cold Archive Storage for Volcengine TOS), the data will be in a state that cannot be directly accessed. In this case, if you need to query, you must first perform a restore operation; after the data is thawed, it can be accessed and analyzed normally.

Create Restore Task¶

Select the time range;
Select the restore mode:
- Quick Retrieval
- Standard Retrieval
- Bulk Retrieval
Select the validity period.

After the task is created, you can view the task progress in the restore task window.

Billing Details¶

Restoring archived data is expected to take some time. This process will generate two fees through the cloud provider: data retrieval fee and temporary copy storage fee, both calculated based on the amount of data restored. However, Guance itself does not charge any additional fees during this process.

Data Explorer¶

On the "Data Explorer" page, you can search and query the latest data results based on the time range and forwarding rules. Here, you can also directly search fields using the key:value format. The system will retrieve files in batches based on the selected time and search for matching data, returning 50 entries per batch. If the first query does not find data or returns less than 50 entries, you can manually click "Continue Query" until the scan is complete.

Search Query Logic

You can use the field :~ value format for search queries, which uses regular expression matching logic.

The system will return all contents containing the field:value string, meaning that if you enter a search condition like host:~ hangzhou, all data containing host: hangzhou will be returned. Exact matching is not supported.
You can connect multiple filter conditions with AND or OR.

Data Forwarding - Query and Restore Duration¶

After configuring the query duration, the query time range will be affected by the duration configuration when viewing forwarded data.

Go to Manage > Workspace Settings > Advanced Settings > Data Forwarding - Query and Restore Duration;
Select the duration;
Confirm.