Indexes¶

By extracting key features such as log fields and metric tags, indexes can associate feature values with raw data, enabling efficient retrieval and avoiding inefficient full-table scans.

After creating and managing multiple indexes, the system will automatically archive log data into the corresponding indexes based on preset filtering conditions. At the same time, you can customize the data storage strategy for each index, effectively controlling and reducing storage costs while balancing data management flexibility and economic benefits.

Create¶

TrueWatch supports creating or binding three types of indexes:

When data is collected into TrueWatch, the system splits and distributes it to indexes or forwards it to other third-party systems based on rules, thereby improving data processing efficiency and meeting the need for multi-path data distribution.

Manage Indexes¶

You can manage the index list through the following operations.

Export Indexes¶

In the corresponding index type list, click the "Export" button in the upper right corner to export the corresponding index JSON file.

Import Indexes¶

Supports importing local index configuration files.

Log Index Mapping¶

Log index mapping is used to automatically select the default log index used for related queries on the detail page based on the field value in the detail data.

Configuration Entry¶

Go to Logs > Indexes, click Log Index Mapping, and then create and manage the mapping relationship between field values and default log indexes.

Configuration Method¶

Each mapping contains:

• Match Field: The field name in the detail data, e.g., app_id, source, service, env, or version;
• Field Value: The field value used to determine whether to match;
• Default Log Index: The log index to query when the field value matches.

Configuration example:

To configure the original "Match Service" capability, set the match field to service, then fill in the service name and the corresponding log index.

Related Query¶

After the configuration takes effect, when viewing related logs from data detail pages such as RUM or APM, the system will read the fields in the current detail data and automatically select all matched available log indexes.

The log count statistics and log list query use the same index matching results to ensure consistency between the count and the list content.

Field Value Matching¶

Field values support the following configuration methods:

• Exact match: e.g., front-backend;
• Multi-value match: multiple values separated by English commas, e.g., api,web;
• Wildcard match:
  • *: matches zero or more arbitrary characters;
  • ?: matches one arbitrary character.

Multiple Rule Hits¶

The system will check all mapping rules and merge all matched available log indexes:

• When the same field value hits multiple mappings, query all corresponding indexes;
• When exact rules and wildcard rules are hit simultaneously, merge all corresponding indexes;
• When multiple rules point to the same index, the system automatically deduplicates;
• Log count statistics and log list query use the same index set.

For example:

When the current service is api-order, the system will query both application-log and order-log.

Index Status Control¶

• Disable index: subsequent logs will no longer enter this index, and will continue to match and flow into other indexes for storage. If no other index matches, they will be stored in the default default index;
• Enable index: subsequent logs will re-enter this index for storage.

Index Configuration Editing¶

Supports editing the configuration of created log indexes.

Index Deletion¶

Click the delete icon to delete a created index.

Index Sorting¶

Click the edit mode: you can drag up and down to adjust the order of created log indexes; supports single select, multi-select across pages to adjust sorting, and can move one or more indexes to a specified position.

Operation Audit¶

Click the audit icon to view all operation logs related to this index.