Skip to content

Create Forwarding Rules

Prerequisites

Only available for Commercial Plan.

Create

Go to Data Forwarding > Forwarding Rules > Create Rules page.

After the data forwarding rule is created, the system will validate the rule every 5 minutes.

1. Enter Rule Name

The name of the current data forwarding rule.

  • Include Extended Fields: By default, only the message field of the log that meets the conditions is forwarded. If "Include Extended Fields" is checked, the entire log data that meets the conditions will be forwarded. APM and RUM data are forwarded in their entirety by default and are not affected by this option.
Note

When creating multiple data forwarding rules, priority is given to rules that include extended fields. If different rules match the same piece of data, the logic of including extended fields will be prioritized to display the entire log data.

2. Define Filter Conditions

  1. Data Source: Includes logs, APM, RUM, events, and audit events.

  2. Filter Conditions: Supports custom logic between conditions; multiple conditions can be added.

    • All Conditions: Only log data that meets all filter conditions will be saved for forwarding;

    • Any Condition: Any log data that meets at least one filter condition will be saved for forwarding.

Condition Operators are as follows:

Condition Operators Match Type
in, not in Exact match, supports multiple values (separated by commas)
match, not match Fuzzy match, supports regular expressions

If no filter conditions are added here, it means all data will be saved.

Pipeline Processing for Forwarded Data

The central Pipeline script affects the filtering and final content of forwarded data. When creating a script, you can check "Enable Pipeline Processing for Forwarded Data": if checked, data will be processed by the script before being filtered and stored; if not checked, the original data will be forwarded directly.

3. Select Archive Type

To provide a more comprehensive data forwarding storage method, the system supports five storage paths.

TrueWatch: Matched log data will be saved to TrueWatch's OSS, S3, or OBS object storage.

AWS S3

Huawei Cloud OBS

Alibaba Cloud OSS

Kafka Message Queue

Note

  • All five archive types are available across the entire site;

  • When selecting TrueWatch as the data forwarding storage object, the minimum log data storage period is 180 days by default, and once the rule is created, it cannot be canceled. Storage fees will be charged daily during this period; you can go to Management > Settings > Change Data Storage Policy to modify it.

Encrypted Storage

After enabling encrypted storage on AWS S3, Huawei Cloud OBS, or Alibaba Cloud OSS, the system will perform symmetric encryption on the forwarded data. If you need to query or view this data later, the system can decrypt the encrypted data and restore it to its original content for display.

What is Symmetric Encryption?

Symmetric encryption is a method of encryption that uses the same key to encrypt and decrypt data, much like a key that can both lock and unlock the same lock.

For more details, refer to Symmetric Encryption.

4. Define Data Viewing Permissions

Set viewing permissions for forwarded data to enhance data security.

All members of the workspace can view the forwarded data.

Specify the member roles that can view the forwarded data.