Observability
  • Log Service
    • Overview
    • Real-time Logs
      • Real-time Logs Overview
      • Push to EdgeOne Log Analysis
      • Push to Tencent Cloud CLS
      • Push to AWS S3-Compatible COS
      • Push to HTTP Server
    • Log Analysis (Beta)
      • Log Analysis(Beta) Overview
      • How to use Log Analysis filter condition
      • How to Modify Log Analysis Query Time Range
    • Offline Logs
    • Related References
      • Field description
        • L7 Access Logs
        • L4 Proxy Logs
        • Edge Function Running Logs
        • Managed Rule Logs
      • Real-Time Log Push Filter Conditions
      • Custom Log Push Fields
      • Customizing Log Output Formats
  • Data Analysis
    • Overview
    • Analytics
    • Web Security Analysis
    • Data Report
    • Related References
      • Sampling Statistics
      • How to use filter condition
      • How to Modify Query Time Range
      • How to Export Statistical Data and Reports
      • How to Use API to Implement Grouping Aggregation in a Single Call
  • AlarmService
    • Custom Statistical Metrics
Docs Overview/
Observability/
Log Service/
Related References/
Real-Time Log Push Filter Conditions/

Real-Time Log Push Filter Conditions

Real-time log delivery tasks support filters, allowing you to deliver only the logs you need and reduce the volume of data processed by downstream systems. The following are the supported log fields and comparison operators.
Note
Currently, only Real-time Logs > L7 Access Logs supports configuring filters for log delivery.

Supported Log Fields

Field Name
Data Type
Description
SecurityAction
String
Final disposition action after request hits security rules, with possible values:
-: Unknown/Not Hit
Monitor: Monitor
JSChallenge: JSChallenge
Deny: Block
Allow: Allow
BlockIP: BlockIP
Redirect: Redirect
ReturnCustomPage: ReturnCustomPage
ManagedChallenge: ManagedChallenge
Silence: Silence
LongDelay: Response after a long delay
ShortDelay: Response after a short delay
SecurityModule
String
The name of the security module that finally handles the request, corresponding to SecurityAction, possible values include:
-: Unknown/Not Hit
CustomRule: Web Protection - Custom Defined Rule
RateLimitingCustomRule: Web Protection - Rate Limiting Rules
ManagedRule: Web Protection - Managed Rules
L7DDoS: Web Protection - CC Attack Protection
BotManagement: Bot Management - Bot Basic Management
BotClientReputation: Bot Management - Client Profile Analytics
BotBehaviorAnalysis: Bot Management - Bot Intelligent Analysis
BotCustomRule: Bot Management - Custom Bot Rules
BotActiveDetection: Bot Management - Proactive Feature Recognition
EdgeResponseStatusCode
Integer
Response status code returned to the client by the nodes.
OriginResponseStatusCode
Integer
origin server Response Status Code,. If no request is sent to the origin, the value is -1.

Supported Comparison Operators

Comparison Operator Name
Support for This Data Type
String
Integer
Equals (matches any value in the list)
✓
✓
Greater than
✕
✓
Less than
✕
✓
Greater than or equal to
✕
✓
Less than or equal to
✕
✓

Example: Filtering logs with HTTP status codes of 4xx/5xx

Sample Scenario

For high-traffic websites, pushing all access logs may place unnecessary load on the downstream analytics platform. You can configure filters to push only the logs you need. For example, you can push only access logs with 4xx or 5xx HTTP status codes to focus on client errors, service failures, and other issues that may require investigation. Follow the steps below to configure log filtering.

Steps

1. Log in to the Tencent Cloud EdgeOne console, enter Service Overview in the left menu bar, and click the site to be configured under Website Security Acceleration.
2. On the Site Details Page, click Log Service > Real-time Logs.
3. On the Real-time Logs page, click Create delivery task.
4. On the Select Log Source page, enter a task name, select the log type and service area, and click Next.
5. On the Select Destination page, select the destination, and click Next.
5.1 Select Filtered Logs.
5.2 Configure the filters as shown in the diagram below:



6. Configure the destination details, and click Ship.