Configuring Doris User Permissions for Guance Data Forwarding¶

The Guance data forwarding feature writes data to the Doris database via Apache Doris Stream Load. To ensure data can be imported normally, you need to create a user with appropriate permissions in Doris for Guance.

Confirm Your Role¶

Please select the path that suits you:

• Path A: I am a Doris administrator (with root or ADMIN privileges) → Execute SQL authorization directly
• Path B: I am not an administrator, I need to ask a DBA/operations colleague for help → Copy the one-click script to the DBA

Prerequisites¶

• An Apache Doris cluster (version 1.2.x or later) has been deployed
• The target database name (e.g., guance_data) has been determined
• The target table name (e.g., log_archive, or to be created automatically by Guance) has been determined
• The HTTP port of Doris FE (default 8030) is reachable from the Guance service

Minimum Permissions Description¶

The Doris user for Guance data forwarding requires the following permissions:

Path A: Administrator Steps¶

Step 1: Connect to Doris Management Node¶

Connect to the Doris FE management port via MySQL client:

mysql -h <Doris_FE_IP> -P 9030 -u root -p

Step 2: Create Target Database (if not exists)¶

CREATE DATABASE IF NOT EXISTS guance_data;

Step 3: Create Dedicated User¶

CREATE USER 'guance_writer'@'%' IDENTIFIED BY 'your_secure_password';

Step 4: Grant Permissions¶

Scenario A: Using "Auto-create Table" (Recommended)¶

Guance will automatically create the target table based on the data type. Database-level permissions need to be granted:

-- Grant database-level permissions (includes table creation, import)
GRANT CREATE_PRIV, INSERT_PRIV, LOAD_PRIV ON guance_data.* TO 'guance_writer'@'%';

Scenario B: Using "Existing Table"¶

The target table has been created in advance. Only table-level write permissions need to be granted:

-- Grant table-level permissions (import)
GRANT INSERT_PRIV, LOAD_PRIV ON guance_data.log_archive TO 'guance_writer'@'%';

Step 5: Verify Permissions¶

1. Verify User Login¶

mysql -h <Doris_FE_IP> -P 9030 -u guance_writer -p

Enter the password and successfully log in, indicating the user was created successfully.

2. View User Permissions¶

SHOW GRANTS FOR 'guance_writer'@'%';

Expected output should include:

+--------------------------------------------------+
| Grants for guance_writer@%                       |
+--------------------------------------------------+
| GRANT INSERT_PRIV, LOAD_PRIV ON guance_data.*    |
| GRANT CREATE_PRIV ON guance_data.*               |  -- Only for auto-create table scenario
+--------------------------------------------------+

3. Verify Stream Load (Optional)¶

Use curl to simulate a Stream Load request (consistent with Guance backend behavior):

curl --location-trusted -u guance_writer:your_secure_password \
  -H "label:test_guance_001" \
  -H "format:json" \
  -H "strip_outer_array:true" \
  -X PUT \
  http://<Doris_FE_IP>:8030/api/guance_data/log_archive/_stream_load \
  -d '{"host":"test","message":"hello"}'

Expected response:

{
    "Status": "Success",
    "NumberLoadedRows": 1,
    "NumberFilteredRows": 0
}

Path B: One-Click Authorization Script for DBA¶

If you are not a Doris administrator, please copy the following script completely and send it to your company's DBA or operations colleague to execute.

-- ============================================
-- Guance Data Forwarding - Doris User Authorization Script
-- 
-- After execution, please ask the DBA to provide the following information back to the applicant:
--   1. Confirm that the user has been created: guance_writer
--   2. Confirm that the database has been created: guance_data (or the database name specified by the applicant)
--   3. Confirm that the FE HTTP port 8030 is open to the Guance service
-- ============================================

-- Step 1: Create database (if not exists)
CREATE DATABASE IF NOT EXISTS guance_data;

-- Step 2: Create dedicated user (please change the password to a strong one)
CREATE USER IF NOT EXISTS 'guance_writer'@'%' IDENTIFIED BY 'please replace with a strong password';

-- Step 3: Grant permissions
-- If Guance needs to auto-create tables (recommended):
GRANT CREATE_PRIV, INSERT_PRIV, LOAD_PRIV ON guance_data.* TO 'guance_writer'@'%';

-- If the table already exists and only write permissions are needed (uncomment the line below, comment the line above):
-- GRANT INSERT_PRIV, LOAD_PRIV ON guance_data.* TO 'guance_writer'@'%';

-- Step 4: Verify (optional)
SHOW GRANTS FOR 'guance_writer'@'%';

After execution, please confirm:

• The user guance_writer has been created and is not locked
• The database guance_data exists
• The permissions have taken effect (SHOW GRANTS output includes INSERT_PRIV, LOAD_PRIV)
• The HTTP port (8030) of Doris FE is network reachable to the Guance service

Verification Method (Recommended: Guance Interface)¶

Prefer to verify using the Guance interface, no need for manual curl:

1. Log in to the Guance console → Management → Data Forwarding → Create Rule
2. Step 1: Fill in the rule name
3. Step 2: Define the forwarding rule (optional, e.g., filter conditions)
4. Step 3:
   • Select Apache Doris as the archive type
   • Fill in the connection address (e.g., 192.168.1.1:8030)
   • Fill in the database name (e.g., guance_data)
   • Fill in the username (e.g., guance_writer)
   • Fill in the password
   • Fill in the target table name (e.g., log_archive)
5. Click the "Test Connection" button

Verification Result Judgment:

Permission Revocation (If Deletion Needed)¶

-- Revoke all permissions
REVOKE ALL PRIVILEGES ON guance_data.* FROM 'guance_writer'@'%';

-- Delete user
DROP USER 'guance_writer'@'%';

Frequently Asked Questions¶

Q1: Test Connection Prompts "Authentication Failed"¶

Troubleshooting Steps: 1. Confirm that the username and password in the Guance configuration are consistent with those created in Doris 2. Confirm that the password does not contain special characters that could cause escaping issues (e.g., @, #, $, etc., it is recommended to wrap with quotes or avoid them) 3. Confirm that the user is not locked:

```sql
SELECT user, host, password_expired FROM mysql.user WHERE user='guance_writer';
```

Q2: Test Connection Prompts "Insufficient Permissions"¶

Troubleshooting Steps:

1. Execute SHOW GRANTS FOR 'guance_writer'@'%' in Doris to confirm permissions have been granted
2. If using "Auto-create table", confirm that CREATE_PRIV permission has been granted
3. If using "Existing table", confirm that INSERT_PRIV and LOAD_PRIV permissions have been granted on that table
4. Confirm that the database name and table name in the Guance configuration match the authorization objects

Q3: Stream Load Returns "Fail" but Permissions Are Configured¶

Troubleshooting Steps:

1. Check if the Doris BE node is accessible (Stream Load is redirected from FE to BE)
2. Check if the target table exists (in the auto-create table scenario, the first write will automatically create the table)
3. Check if the table field types are compatible with the data (type mismatch will fail in strict mode)
4. Check if the label is duplicated (the same label cannot be reused within 24 hours)

Q4: Table Creation Fails When Using "Auto-create Table"¶

Troubleshooting Steps:

1. Confirm that the user has CREATE_PRIV permission
2. Confirm that the database exists (CREATE DATABASE IF NOT EXISTS)
3. Confirm that the table name does not conflict (the system uses CREATE TABLE IF NOT EXISTS, which will not overwrite existing tables)
4. Check if the Doris cluster has sufficient disk space

Q5: Guance Prompts "Connection Timeout"¶

Troubleshooting Steps:

1. Confirm that the HTTP address and port (8030) of Doris FE are filled in correctly
2. Confirm that the network from the Guance service to Doris is reachable (firewall, security group, VPC peering, etc.)
3. If Doris is on the intranet, confirm that the Guance workspace is in the same network environment as Doris or the network has been established

Minimum Permissions Quick Reference Table¶

Reference Documents¶

• Apache Doris Stream Load Official Documentation
• Apache Doris Permission Management