Skip to content

Delayed Log Visibility

Manage > Workspace Settings > Advanced Settings supports setting a unified delayed visibility window for log queries. After it is enabled, the system automatically applies a unified visibility restriction to log queries. New logs within the delay window are not available to user queries; only log data before the delay window can be queried. This feature only affects query visibility and does not affect log ingestion, Monitors, or alert processing.

When this feature is disabled, log query behavior remains unchanged.

Configuration Steps

  1. Go to Manage > Workspace Settings > Advanced Settings;
  2. Find the Delayed Log Visibility module and click Set;
  3. Enable the Enable Delayed Log Visibility toggle;

  4. Select the index scope:

    • All: applies to all indexes in the current Workspace with a unified delay time configuration
    • Custom: configure different delay times for different indexes

    • Configure the delay time:

    • When All is selected, choose the window duration from the delay time dropdown (1 minute, 5 minutes, 10 minutes, 15 minutes, and 30 minutes are supported);

    • When Custom is selected, click Add Rule, select the index, and set the delay time. Different delay times can be configured for different indexes; the same index cannot be configured repeatedly in multiple rules; indexes without a delayed visibility configuration are not subject to delay restrictions.

  5. Click OK to save the configuration.

Query Delay Rules

  1. When querying a single index, the delay time configured for that index applies;

  2. When querying multiple indexes, if different indexes have different delay times, the strictest delay time applies to the entire query, that is, the maximum delay time among all matched indexes.

Scope of Impact

  • Affected: log query behavior. After this feature is enabled, all users can only query log data before the delay window.
  • Not affected: log ingestion, monitor detection, alert triggering, event generation, data forwarding, and other internal system pipelines.