Cross-Workspace Index Query¶

Introduction¶

To centrally manage, retrieve, and analyze various logs, TrueWatch can collect logs and uniformly report log data to a workspace. Users can view and search all log content within the workspace through the Explorer, enabling more comprehensive log data analysis.

Simultaneously, the TrueWatch platform provides indexing functionality. It defines classification rules for log data, allowing users to save and access logs through different indexes, and implement data storage strategies as needed to effectively control storage costs.

Background¶

Feature Characteristics

From the previous context, it is not difficult to discern the subordinate characteristics of indexes and logs: both logs and indexes are specific to the workspace they belong to. Logs are stored within the workspace, and indexes are special classification and storage rules created for the log data within that space.

Business Challenges

Enterprises often create multiple workspaces in TrueWatch for data management to meet requirements such as cost calculation for different teams or data resource permission control.

While this model addresses the scenario of decentralized data management by department, it is not conducive to global data analysis.

The Necessity of Cross-Space Index Retrieval

Based on the need for global data analysis under decentralized management, TrueWatch provides cross-workspace query functionality, allowing access to log data from other spaces.

Specifically, since logs are categorized by index, after authorizing the index data of "Workspace 1" to "Workspace 2", the indexes of "Workspace 1" can be retrieved in the Explorer of "Workspace 2", thereby enabling access to the log data under the corresponding indexes.

This functionality breaks through the limitation of log data storage location, significantly improving the efficiency of data analysis and fault localization.

Getting Started¶

If authorizing the index data of "Workspace 1" to "Workspace 2", for "Workspace 2", the callable indexes fall into two categories:

The original indexes of the current workspace;
Indexes authorized by other workspaces.

Querying the Original Indexes of This Workspace¶

Enter the Explorer of "Workspace 2". The "Workspace" dropdown in the upper left corner defaults to the current workspace.

All available original indexes of this workspace are listed in the Quick Filters on the left, which are: the default index, log indexes, and external indexes.

Note

External indexes are single-select.

Querying Indexes Authorized by Other Workspaces¶

If "Workspace 2" needs to access the index data of "Workspace 1", authorizing indexes across workspaces involves two steps:

Authorize the corresponding log items and indexes in the workspace that needs to perform the authorization (Workspace 1);
Enter the authorized workspace (Workspace 2) and select the index items to apply.

For detailed operational steps, please refer to Cross-Workspace Authorization.

Once the above two steps are completed, meaning the index authorization from "Workspace 1" to "Workspace 2" is done, navigate to the authorized workspace---"Workspace 2" > Explorer.

Selecting a Workspace¶

Click the Workspace dropdown to view all available workspaces. Single or multiple selection is supported here.

Note

The list of available workspaces here only includes those that meet three conditions: belong to the same cluster; the authorization operation has been completed; the authorized data scope includes log data.
Selecting a single space will directly display the name of the selected workspace in the workspace bar; when multiple workspaces are selected, it will display as: n items selected, and clicking will show the specific options.

Selecting Indexes¶

After selecting the workspace(s), the indexes under those workspaces will be synchronously listed in the Quick Filters:

Note

External indexes do not support cross-workspace queries. External indexes are only available when the current workspace is selected. If other workspaces are selected, external indexes become unavailable.
The log index defaults to selecting default. When multiple workspaces are selected, all default indexes from those spaces are grouped under the same default index.
For cross-workspace authorized indexes, only the available indexes within the authorized scope are listed synchronously.

Analyzing Log Data¶

Cross-workspace index query only affects the channel for acquiring log data; other log analysis functionalities remain unaffected.

After selecting the workspace(s) and index(es) in the Explorer, you can normally use the original functions of the Explorer, such as search, quick filtering, status chart display, and analysis.

Deleting an Index¶

If you delete index a under Workspace 1, and this index has been authorized to another space, for example, Workspace 2, a confirmation prompt will appear upon deletion.

Once confirmed, this change will immediately affect "Workspace 2", and the corresponding index will become unavailable.