SLS Logtail Template Guide

Welcome to the documentation on SLS Logtail Template. Logtail is a lightweight and efficient agent for collecting logs from various sources and sending them to SLS (Log Service) for centralized log management.

Overview

Logtail Template is used to define the structure and format of logs collected by Logtail. It helps in parsing logs from different sources and making them suitable for analysis in SLS.

Features

Flexible Parsing: Customize the parsing rules to handle various log formats.
Real-time Collection: Collect logs in real-time and send them to SLS.
Scalable and Reliable: Support large-scale log collection with high reliability.

Getting Started

Install Logtail: Download and install Logtail.
Create a Logtail Template: Define the log format and parsing rules in the template file.
Configure Logtail: Set the template file for the target log source.

Example Template

- source: /var/log/syslog
  type: tail
  read_from_head: true
  pos_file: /tmp/logtail.pos
  tags:
    - service: webserver
    - environment: production
  filters:
    - type: regex
      pattern: '^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}).*'
      key: timestamp
  processors:
    - type: regex
      pattern: '^(.*?) \[(.*?)\]'
      fields:
        - name: timestamp
          value: ${1}
        - name: log_level
          value: ${2}

Resources