Skip to content

Indexes

By extracting key features such as log fields and metric tags, indexes can associate feature values with raw data, enabling efficient retrieval and avoiding inefficient full scans.

After creating and managing multiple indexes, the system will automatically archive log data into corresponding indexes based on preset filter conditions. Simultaneously, you can customize data storage policies for each index, effectively controlling and reducing storage costs, balancing data management flexibility with economic benefits.

Create

TrueWatch supports creating or binding three types of indexes:

Index Type
 Definition Core Features and Data Flow Control Ownership
Log Index The basic log storage unit in TrueWatch. After log data is reported, the system automatically sorts and stores it into matching indexes based on preset rules (e.g., matching conditions, filters). Rule-based automatic sorting

Collector → TrueWatch unified reception → Sorting by rules → Writing to target index		 TrueWatch platform console
(Control is achieved by configuring index rules)
Direct Write Index A write method where the collector directly specifies the target index name. Data bypasses the default sorting rules on the platform side and is written directly to the specified index. Direct write to specified target

Collector (specifies index name) → Directly writes to target index		 Collector configuration
(Specified in the configuration of collection ends like DataKit)
External Index A cross-data-source query integration feature provided by TrueWatch. Through binding authorization, an external data source (e.g., self-built ES) is mapped to a logical index within the workspace that can be queried uniformly. External data source binding and unified query

Data is stored externally, TrueWatch establishes query channels for retrieval.		 External data source system
(Data ownership and storage management are external)

When data is collected into TrueWatch, the system will distribute it to indexes or forward it to other third-party systems based on rules, thereby improving data processing efficiency and meeting the needs of multi-path data distribution.

Manage

You can manage the index list through the following operations.

Index Status Control

  • Disable an index: Subsequent logs will no longer enter this index and will continue to match and flow into other indexes for storage. If no other index matches, they will be saved in the default default index.
  • Enable an index: Subsequent logs will re-enter this index for storage.

Index Configuration Editing

Supports editing the configuration of created log indexes.

Note

Changing the storage policy will delete data in the index. Please operate with caution.

Index Deletion

Click the delete icon to delete a created index.

Note
  • After deletion, the log data in this index will also be deleted. If no other matching index exists, subsequently reported log data will be saved in the default default index.
  • If the deleted index has been authorized for querying by other workspaces, those spaces will no longer be able to query this index after deletion.
  • After deleting a log index, you can create an index with the same name as needed.

Index Sorting

Click the sort icon to drag and adjust the order of created log indexes up or down.

Note

Logs flow into the first matching index. Changing the index order may alter the log flow direction.

Operation Audit

Click the audit icon to view all operation logs for this index.