Manage ingest processors
Ingest processors preprocess logs before writing them to a Logstore. You can use ingest processors to filter data, extract or extend fields, and mask sensitive information.
Create an ingest processor
-
Log on to the Simple Log Service console.
-
Go to the Data Processor page.
-
In the Projects section, click the target project.
-
In the left-side navigation pane, choose
-
-
On the Ingest Processor tab, click Create. In the Create Processor panel, configure Processor Name, SPL, and Error Handling, and then click OK.
Parameter
Description
Processor name
The ingest processor name.
Description
The ingest processor description.
SPL
The SPL statement. For supported syntax, see SPL syntax.
Error Handling
The action to take when SPL processing fails:
-
Retain Raw Data
-
Discard Raw Data
Note-
Processing failures are SPL execution errors, such as an operator failing on invalid data. SPL syntax errors are not included.
-
If an SPL syntax error causes a parsing failure, the system retains the raw data by default.
-
Modify or delete an ingest processor
On the tab, find the target ingest processor and click Modify or Delete.
-
If the ingest processor is associated with a Logstore, the updated configuration takes effect within one minute. New logs are preprocessed with the updated settings before being written to the Logstore.
-
If you delete an associated ingest processor, the system stops preprocessing new logs and writes raw data directly to the Logstore.
Associate an ingest processor
-
In the target project, click the
icon in the right-side navigation pane. Hover over the target Logstore and click 
> Modify. -
On the Logstore properties page, click Modify in the lower-right corner. In edit mode, select an ingest processor from the Ingest Processor list, and then click Save in the lower-right corner.
NoteAfter you associate the ingest processor, changes take effect on new logs within about one minute.
Disassociate an ingest processor
On the Logstore properties page, click Modify in the upper-right corner. In edit mode, click the 
icon to clear the ingest processor, and then click Save in the upper-right corner.
After you disassociate the ingest processor, the system writes new raw data directly to the Logstore after about one minute.