Why does the log query fail?

1. Error causes during log search: Currently, log search requires corresponding index configurations to query the corresponding bar charts and log content; otherwise, an error will prompt that the index is not configured

• For example, match GET full-text search requires configuring full-text index
• For example, match method:GET field search requires configuring the corresponding field-level index
• For example, to query match * all logs, it currently requires configuring either a full-text index or a field-level index
  

2. Reasons for errors in SELECT statistic analysis are as follows:

• If a search statement precedes SELECT, corresponding index needs to be configured for search content; otherwise, an error will occur
• If the SELECT statistical analysis statement contains syntax errors, related errors will occur

Why can't my transmission task retrieve logs?

If your transmission task fails to collect logs, follow these troubleshooting steps.

Step 1: Check the console for any exception messages. If present, troubleshoot accordingly.

1. Please check the agent status under the task. If "Lost" is displayed, it indicates the agent cannot send heartbeats; please check the host network status. If "Exception" is displayed, make corresponding adjustments based on the exception message. Common exceptions include:

   • "File access permission denied": Adjust file and directory permissions accordingly. The adjustment method requires that the user running the agent has read (r) permissions for the collected files and read+execute (r+x) permissions for all parent directories up to the root directory.
   • "Bucket does not exist": In this case, check whether the region of the configured bucket matches the BLS region.

Step 2: Reconfirm whether data has reached the destination location

1. If transmitting logs to BOS with log aggregation enabled, check the target files in the specified BOS bucket and aggregation path.

2. The collection status of target files can be checked through checkpoint files

   Method: Sign into the target host, navigate to the agent installation directory (default path: /opt/logbeat), locate the checkpoint file at data/registry/{taskID}/data.json, and open it with the less command. Its content is a JSON array where each object represents a file identifier, formatted as:

   {"source":"/home/bls/log/server/bls_server.log.2020110523","offset":53096994,"timestamp":"2020-11-06T00:01:05.435819387+08:00","ttl":176400000000000,"type":"log","meta":null,"FileStateOS":{"inode":75504128,"device":2056}}

   The source field represents the system's file name, while the offset field indicates the confirmed offset of the data collected and transmitted. If the value is 0, the file may still be undergoing collection and transmission. In the absence of a checkpoint file, proceed with troubleshooting.

3. Check whether the task has been deployed to the host

   Under normal conditions, the newest configuration will be deployed to the host within 3 minutes of modifying the task. You can verify deployment by checking the local cache file for the deployed configuration. The task configuration cache file is located at: installation path/config/management.yml. Note that any manual edits to this file will be invalid.

Step 3: Check if the target file is within the collection scope

1. Regular expressions are not supported for file directories, but glob patterns are allowed https://golang.org/pkg/path/filepath/#Match).
2. File rules must adhere to standard regular expression syntax. For example, avoid starting an expression with (e.g., .log). Test the expression to ensure it matches the intended target files.
3. Real-time log absolute paths must not include backslashes \ in filenames, as forward slashes and backslashes are both treated as path delimiters. For instance, /home/bls/log/server\.log will be interpreted as /home/bls/log/server/.log.
4. Check whether target logs are excluded by file rules, and modify the exclusion rules if necessary.
5. Verify whether the last modification time of the target file falls within the configured valid period. Calculation: Confirm whether the file's last modification time is more recent than the configured valid period (in days) × 24 hours.
6. If BOS logs are configured with time aggregation, ensure the log filename includes the specified time format; otherwise, the file will be ignored.

Finally:

If the issue continues after trying all troubleshooting steps, you can submit a ticket to BLS for further help. Make sure to include the following details in your ticket:

1. Region where your task is configured;
2. Task ID;
3. Host log; To obtain it, sign in to the target host and check the runtime log file in the agent installation directory. The default installation path is /opt/logbeat, and the log location is logs/logbeat.

Why is my agent in "Uncertified" status?

An agent in "uncertified" status means its token has expired. To maintain normal log transmission tasks, create a new token promptly and redeploy the agent on the relevant host.

Why is the Copy button for the installation command not displayed in the browser?

1. Start by checking if the browser has the Flash plugin installed. Here are the Flash support details for browsers:

   • Chrome comes with Flash support by default.
   • IE and Firefox have Flash plugins pre-installed by default.
   • On OSX, Firefox and Safari do not support Flash by default; you’ll need to install it.
2. If the installation command still cannot be copied, please assemble Linux or Windows environment installation commands according to Agent Installation Command Samples and Explanations.

Note: Different regions require corresponding installation scripts. The installation script URL for each region are as follows:

Beijing: https://logbeat-repo-bj.bj.bcebos.com/install-logbeat.sh

Guangzhou: https://logbeat-repo-gz.gz.bcebos.com/install-logbeat.sh

Suzhou: https://logbeat-repo-sz.su.bcebos.com/install-logbeat.sh

Baoding: https://logbeat-repo-bd.bd.bcebos.com/install-logbeat.sh

Hong Kong: https://logbeat-repo-hk.hkg.bcebos.com/install-logbeat.sh

Wuhan: https://logbeat-repo-wh.fwh.bcebos.com/install-logbeat.sh

The listed commands are for Linux scripts. For Windows scripts, simply replace "sh" with "bat."

Additionally, on Windows systems, you can also install using the ZIP package. Please refer to Windows ZIP Installation Method.

Why is the transmitted data reset to zero?

Reasons are as follows:

1. The agent installed on the host has been updated with a new token. As a result, the log service will re-identify and certify the agent, and historical information linked to the old token will be cleared.
2. When a host is removed from the task's host list, its historical data will not be preserved. If the same task is redeployed to this host, the data transmission counter will reset to zero.