Log Visibility Delay¶

Management > Workspace Settings > Advanced Settings supports setting a unified visibility delay window for log queries. When enabled, the system automatically adds a unified visibility restriction to log queries. New logs within the window period are not available for user queries, and only log data before the delay window can be queried. This feature only affects query visibility and does not affect log ingestion, monitor checks, or alert processing.

When the feature is disabled, log query behavior remains unchanged.

Configuration Steps¶

1. Go to Management > Workspace Settings > Advanced Settings;
2. Find the Log Visibility Delay module and click Configure;
3. Turn on the Enable Log Visibility Delay switch;

4. Select the index scope:

   • All: Applies to all indexes in the current workspace, with a uniformly configured delay time.
   • Custom: Configure different delay times for different indexes.

   • Configure the delay time:

   • When selecting "All", choose the window duration from the delay time dropdown (supports 1 minute, 5 minutes, 10 minutes, 15 minutes, 30 minutes);

   • When selecting "Custom", click "Add Rule", select an index and set its delay time. Supports configuring different delay times for different indexes; the same index cannot be configured repeatedly across multiple rules; indexes without a configured visibility delay are not subject to any delay restriction.

5. Click OK to save the configuration.

Query Effectiveness Rules¶

1. When querying a single index, the delay time configured for that index takes effect;

2. When querying multiple indexes, if different indexes have different delay times, the strictest delay time applies to the entire query, i.e., the maximum delay time among all matched indexes is used.

Scope of Impact¶

• Affected: Log query behavior. After enabling, all user log queries will only return data before the delay window.
• Not Affected: Log data ingestion, monitor checks, alert triggering, incident generation, data forwarding, and other internal system processes.