This topic describes the procedure for collecting Elastic Compute Service (ECS) logs by using Logtail in the Log Service console.
- ECS and Log Service are activated.
- A project and a Logstore are created in Log Service. For more information, see Preparations.
Note Make sure that your Log Service project and ECS instances reside in the same region if the network type of ECS instances is the classic network or Virtual Private Cloud (VPC).
- Your Alibaba Cloud account ID is configured as an AliUid for ECS instances under different Alibaba Cloud accounts from your Log Service project. This guarantees that Log Service can automatically obtain the owner information of ECS instances. For more information, see Configure AliUids for ECS servers under other Alibaba Cloud accounts or on-premises IDCs.
- Log on to the Log Service console, and then click the target project name.
- Select a data type.
On the Overview page, click Import Data in the upper-right corner. In the Import Data dialog box, select Single Row - Text Log.
- Select a Logstore.
You can select an existing Logstore, or create a project and a Logstore.Note Make sure that your Log Service project and ECS instances reside in the same region if the network type of ECS instances is the classic network or VPC.
- Create a server group.
Before creating a server group, make sure that Logtail is installed.
- Servers of Alibaba Group: By default, Logtail is installed on these servers. If Logtail is not installed on a server, contact Alibaba Cloud as prompted.
- ECS instances: Select ECS instances and click Install. ECS instances that are running in Windows do not support one-click installation of Logtail. In this case, you need to manually install Logtail. For more information, see Install Logtail in Windows.
- On-premises servers: Install Logtail as prompted. For more information about how to install Logtail, see Install Logtail in Linux or Install Logtail in Windows based on your operating system.
- Configure the server group.
Move the server group from Source Server Groups to Applied Server Groups.
- Create a Logtail configuration.
For more information about how to configure the data source, see Collect text logs. The following figure shows how to configure the data source in Simple Mode.Enter the path of ECS logs, set other parameters as required, and then click Next.Note
- It takes up to 3 minutes for a Logtail configuration to take effect after being created.
- For more information about Logtail collection errors, see Diagnose collection errors.
- Configure log query and analysis.
- Full Text Index
You can enable Full Text Index and Include Chinese. Choose whether to enable Case Sensitive and set Delimiter.
- Field Search
Click the plus sign (+) below Key Name to add a line. Set Key Name, Type, Alias, Case Sensitive, and Delimiter. Choose whether to enable Include Chinese and Enable Analytics.
- You must set Full Text Index or Field Search. If you set both of them, the settings of Field Search prevail.
- When the index type is long or double, the Case Sensitive and Delimiter settings are unavailable.
- For more information about how to create indexes, see Enable and set indexes. Note that some fields are reserved fields for Log Service.
- To use an NGINX template or Message Service (MNS) template, set Index Attributes on the Search & Analysis page.
- Full Text Index
After the Logtail configuration is created, you can log on to an ECS instance or run
echo "test message" >> /var/log/message command to generate logs in the local
/var/log/message directory. Then, Logtail collects these logs and stores them to Log Service.
Return to the Overview page. Click the icon next to the target Logstore name and select Search & Analysis or Consumption Preview to view the logs collected by Logtail.