Quick Start

1.1 Create a project and a LogStore

1. Log on to the Simple Log Service console.

2. Create a project.

   In the Projects section, click Create Project. For this example, create a project named web-project-test in the Philippines (Manila) region. For more information, see Manage projects.

   

3. Create a LogStore.

   After you create the project, the system prompts you to create a LogStore. For this example, create a LogStore named website_log. For more information, see Manage LogStores.

1.2 Collect Nginx access logs

A website stores its Nginx access logs in the /var/log/nginx/access.log file on an ECS host. The logs are output as single lines by default. A sample access.log entry:

192.168.1.75 - David [2024-07-31T14:27:24+08:00] "PUT /request/path-0/file-8 HTTP/1.1" 819 21577 403 73895 www.test5.com www.test2.com "Mozilla/5.0 (Windows NT 5.2; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1"

Use Logtail to collect Nginx logs from the ECS host. For the procedure, see Collect text logs from a host. Collect the logs from /var/log/nginx/access.log to website_log. The following figure shows the LogSearch page.

You can also use an SDK for data collection. For more information, see Quick Start for Java SDK and Overview of data collection.

2.1 Go to the Data Processors page

1. In the Projects section, click web-project-test.

   

2. In the navigation pane on the left, click Resource > Data Processors.

   

2.2 Create an Ingest Processor

1. On the Data Processors > Ingest Processor tab, click Create.

   

2. In the Create Processor panel, configure the parameters as shown in the following figure and click OK.

   

   The following SPL configuration is used. The Ingest Processor uses SPL to process data. For more information, see SPL syntax.

   * 
   | parse-regexp content, '(\S+)\s-\s(\S+)\s\[(\S+)\]\s"(\S+)\s(\S+)\s(\S+)"\s(\d+)\s(\d+)\s(\d+)\s(\d+)\s(\S+)\s(\S+)\s"(.*)"' as remote_addr, remote_user, time_local, request_method, request_uri, http_protocol, request_time, request_length, status, body_bytes_sent, host, referer, user_agent
   | project-away content
   | extend __topic__ = request_method

3.1 Associate the Ingest Processor with the LogStore

1. In the navigation pane on the left, click Log Storage. Hover the mouse pointer over website_log and click Modify.

   

2. On the properties page of website_log, click Modify in the upper-right corner. In edit mode, set Ingest Processor to the Parse Nginx logs processor that you created, and then click Save.

   

3.2 Query and analyze logs

In the navigation pane on the left, click Log Storage. On the LogSearch page, view the parsed logs.