In the log of the product easy to use, the use of some of the key features is that users relatively high degree of attention, more frequent use, such as reports, regular tasks, such as the dashboard display. Today, we would say in detail using the following regular tasks.
Operating logic timer task 1
Timing Timing is initiated by the task easy to log back-end module, the SPL statement the relevant search results and save, and to view operating results in the history of the front page after the task runs. The advantages of regular tasks that can save the query results on a regular basis, so that the latter view real-time.
Performing regular tasks are the following:
1, enter the search statement, a search is performed;
2, save the search results as a "timer task";
3, the timing of the task related information is recorded in a corresponding database;
4, according to the task related rules Search statements (Query), and the operation frequency of the first-run time configuration, the rear end of the timing module to perform the task;
5, according to the size parameter predetermined timing task rules limit the number of pieces, the task execution result storage index, while the results are reported to the front desk to see the local timing for the task of operating results.
2 regular task creation process
The task of the timing step to create the timing process has the following tasks.
2.1 perform searches, create a "regular job."
And perform a search after search interface definition statement, through the "Save As" to open the "Custom Task" Create Page.
2.2 Timing job creation
It should be noted that:
1, "log sources" with the relevant authority, the default is All;
2, either manually specify the search statement timerange (search time), or use search timerange choice, as far as possible with the implementation of the plan execution interval consistent execution interval than if a large timerange discontinuity occurs results (results not statistically middle portion); if less than the execution interval occurs timerange time statistics partially overlap;
3, "save the number of" default is 20000;
4, if less than the current start time of the selected time, then the task will first run time is the second day of the moment.
2.3 "scheduled task" View execution details
Open the "regular job" menu to see the timing of implementation of the mandate, where the ID refers to the number of executions "time task". Clicking on a "regular job" in the name, you can enter the task details page, check the running of the cron job. In the task details page, you can click to open the resulting data from a specific run.
2.4 "scheduled task" Query results
Results after storage timer task may be scheduled task query by searching the index can be used index = schedule schedule_name: xxxx (xxxx replace specific task name) or index = schedule schedule_id: xxxx search, as shown below:
3 regular tasks personalized configuration
In the process of using a timed task, users often need to be customized according to their needs. Common tasks timing personalized settings are listed below.
3.1 retains the results of several settings
Timing reserved task execution result storage i.e. the number of index numbers, easy to support the modification log size parameter configured size when the timing task, to retain a suitable number of results based on actual production needs.
The performance and stability considerations, set this parameter needs to carefully weigh.
3.2 task results history retention setting
More than a certain time of the scheduled task execution results, value retention may be reduced gradually. At this time, the user can set the timing parameters via the task results history retention time, timely removal of miscellaneous data, in order to maintain efficient performance of the system.
3.3 regular tasks taken up
Some regular tasks of the higher data value can be due to network or personal settings, sometimes the data can not be collected in time, this time, the data can be re-collected through the "regular tasks fill mining."
In the process easy to use logs, which are experiencing confusion? Welcome to our message, oh, the log is easy to product experts is at your doubts!