This topic describes the procedure for collecting Elastic Compute Service (ECS) logs by using Logtail in the Log Service console.


  • ECS and Log Service are activated.
  • A project and a Logstore are created in Log Service. For more information, see Preparations.
    Note Make sure that your Log Service project and ECS instances reside in the same region if the network type of ECS instances is the classic network or Virtual Private Cloud (VPC).
  • Your Alibaba Cloud account ID is configured as an AliUid for ECS instances under different Alibaba Cloud accounts from your Log Service project. This guarantees that Log Service can automatically obtain the owner information of ECS instances. For more information, see Configure AliUids for ECS servers under other Alibaba Cloud accounts or on-premises IDCs.

Configuration process

The collection configuration process starts after you select a data type.Configuration process


  1. Log on to the Log Service console, and then click the target project name.
  2. Select a data type.
    On the Overview page, click Import Data in the upper-right corner. In the Import Data dialog box, select Single Row - Text Log.
  3. Select a Logstore.
    You can select an existing Logstore, or create a project and a Logstore.
    Note Make sure that your Log Service project and ECS instances reside in the same region if the network type of ECS instances is the classic network or VPC.
  4. Create a server group.
    Before creating a server group, make sure that Logtail is installed.
    • Servers of Alibaba Group: By default, Logtail is installed on these servers. If Logtail is not installed on a server, contact Alibaba Cloud as prompted.
    • ECS instances: Select ECS instances and click Install. ECS instances that are running in Windows do not support one-click installation of Logtail. In this case, you need to manually install Logtail. For more information, see Install Logtail in Windows.
    • On-premises servers: Install Logtail as prompted. For more information about how to install Logtail, see Install Logtail in Linux or Install Logtail in Windows based on your operating system.
    After installing Logtail, click Complete Installation to create a server group. If you have created a server group, click Use Existing Server Groups.
  5. Configure the server group.
    Move the server group from Source Server Groups to Applied Server Groups.
  6. Create a Logtail configuration.
    For more information about how to configure the data source, see Collect text logs. The following figure shows how to configure the data source in Simple Mode.
    Enter the path of ECS logs, set other parameters as required, and then click Next.
    Figure 1. Simple mode
    Simple mode
    • It takes up to 3 minutes for a Logtail configuration to take effect after being created.
    • For more information about Logtail collection errors, see Diagnose collection errors.
  7. Configure log query and analysis.
    • Full Text Index

      You can enable Full Text Index and Include Chinese. Choose whether to enable Case Sensitive and set Delimiter.

    • Field Search

      Click the plus sign (+) below Key Name to add a line. Set Key Name, Type, Alias, Case Sensitive, and Delimiter. Choose whether to enable Include Chinese and Enable Analytics.

    • You must set Full Text Index or Field Search. If you set both of them, the settings of Field Search prevail.
    • When the index type is long or double, the Case Sensitive and Delimiter settings are unavailable.
    • For more information about how to create indexes, see Enable and set indexes. Note that some fields are reserved fields for Log Service.
    • To use an NGINX template or Message Service (MNS) template, set Index Attributes on the Search & Analysis page.
The Logtail configuration for collecting ECS logs is created. To configure LogShipper for collected logs, continue with the follow-up configuration as prompted.

View logs

After the Logtail configuration is created, you can log on to an ECS instance or run the echo "test message" >> /var/log/message command to generate logs in the local /var/log/message directory. Then, Logtail collects these logs and stores them to Log Service.

Return to the Overview page. Click the Manage icon icon next to the target Logstore name and select Search & Analysis or Consumption Preview to view the logs collected by Logtail.

Figure 2. View logs
Preview logs
Figure 3. Preview logs
Consumption Preview
Figure 4. Query logs
Query logs