Simple Log Service:Quick Start

1.1 Create a project and a LogStore

1. Log on to the Simple Log Service console.

2. Create a project.

   In the Projects section, click Create Project. For this example, create a project named web-project-test in the Philippines (Manila) region. For more information about configurations, see Manage projects.

   

3. Create a LogStore.

   After you create the project, the system prompts you to create a LogStore. For this example, create a LogStore named website_log. For more information about configurations, see Manage LogStores.

1.2 Collect Nginx access logs

A website stores its Nginx access logs in the /var/log/nginx/access.log file on an ECS host. The logs are output as single lines by default. The content of access.log is as follows:

192.168.1.75 - David [2024-07-31T14:27:24+08:00] "PUT /request/path-0/file-8 HTTP/1.1" 819 21577 403 73895 www.test5.com www.test2.com "Mozilla/5.0 (Windows NT 5.2; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1"

Use Logtail to collect Nginx logs from the ECS host. For the procedure, see Collect text logs from a host. Collect the logs from /var/log/nginx/access.log to website_log. The LogSearch page is shown in the following figure.

You can also use a software development kit (SDK) for data collection. For more information, see Quick Start for Java SDK. For more information, see Overview of data collection.

2.1 Go to the Data Processors page

1. In the Projects section, click web-project-test.

   

2. In the navigation pane on the left, click Resource > Data Processors.

   

2.2 Create an Ingest Processor

1. On the Data Processors > Ingest Processor tab, click Create.

   

2. In the Create Processor panel, configure the parameters as shown in the following figure and click OK.

   

   The SPL configuration is as follows. The Ingest Processor uses SPL to process data. For more information about SPL, see SPL syntax.

   * 
   | parse-regexp content, '(\S+)\s-\s(\S+)\s\[(\S+)\]\s"(\S+)\s(\S+)\s(\S+)"\s(\d+)\s(\d+)\s(\d+)\s(\d+)\s(\S+)\s(\S+)\s"(.*)"' as remote_addr, remote_user, time_local, request_method, request_uri, http_protocol, request_time, request_length, status, body_bytes_sent, host, referer, user_agent
   | project-away content
   | extend __topic__ = request_method

3.1 Associate the Ingest Processor with the LogStore

1. In the navigation pane on the left, click Log Storage. Hover the mouse pointer over website_log and click Modify.

   

2. On the properties page of website_log, click Modify in the upper-right corner. In edit mode, set Ingest Processor to the Parse Nginx logs processor that you created, and then click Save.

   

3.2 Query and analyze logs

In the navigation pane on the left, click Log Storage. On the LogSearch page, view the parsed logs, as shown in the following figure.