Manage projects

更新时间:
复制 MD 格式

A project is the basic unit for managing resources in Simple Log Service (SLS). It provides resource isolation, access control, and an entry point for accessing SLS resources.

What is a project

In Simple Log Service (SLS), a project is the primary unit for isolating resources and managing access.

Using different projects offers the following benefits:

  • Organize and manage different LogStores or MetricStores: In practice, you may need to use SLS to collect and store logs from various projects, products, or environments. You can manage these logs in different projects to simplify their consumption, export, or analysis.

  • Isolate access control: You can grant a RAM user permissions to perform operations on a specific project.

  • Provide a resource access entry point: SLS provides an independent service endpoint for each project. You can use this endpoint to write, read, and manage logs over the network. For more information about endpoints, see Service endpoints.

Permissions

  • If you sign in with an Alibaba Cloud account, you have full permissions by default and can directly manage projects.

  • If you sign in as a RAM user, request the appropriate SLS system policies from the Alibaba Cloud account owner.

    • AliyunLogFullAccess: Grants full permissions to manage SLS.

    • AliyunLogReadOnlyAccess: Grants read-only permissions for SLS.

    If the system policies do not meet your requirements, you can create a custom policy for fine-grained permission management. For more information, see the following table and Create a custom policy.

    Actions

    Required permissions

    Create a project

    • log:ListProject

    • log:CreateProject

    Delete a project

    • log:ListProject

    • log:GetProject

    • log:DeleteProject

    Operations on projects in the recycle bin

    • log:ListProjectsInRecycleBin

    • log:CreateProject

    • log:DeleteProject

    • log:UpdateProject

    View a specific project

    • log:ListProject

    • log:GetProject

    • log:ListLogStores

    • log:ListSavedSearch

    • log:ListDashboard

    • log:ListDomains

    • log:GetSqlInstance

    • log:ListTagResources

    Manage resource quotas

    Same as the permissions required to view a specific project.

    Configure transfer acceleration

    • log:ListProject

    • log:GetProject

    • log:ListLogStores

    • log:ListSavedSearch

    • log:ListDashboard

    • log:ListDomains

    • log:GetSqlInstance

    • log:ListTagResources

    • log:PutProjectTransferAcceleration

    Configure a resource group

    • log:ListProject

    • log:GetProject

    • log:ListLogStores

    • log:ListSavedSearch

    • log:ListDashboard

    • log:ListDomains

    • log:GetSqlInstance

    • log:ListTagResources

    • log:ChangeResourceGroup

    Configure tags

    • log:ListProject

    • log:GetProject

    • log:ListLogStores

    • log:ListSavedSearch

    • log:ListDashboard

    • log:ListDomains

    • log:GetSqlInstance

    • log:ListTagResources

    • log:TagResources

    • log:UntagResources

    Configure a custom domain

    • log:ListProject

    • log:GetProject

    • log:ListLogStores

    • log:ListSavedSearch

    • log:ListDashboard

    • log:ListDomains

    • log:GetSqlInstance

    • log:ListTagResources

    • log:CreateDomain

    Monitor project resources

    • log:ListProject

    • log:GetProject

    • log:ListLogStores

    • log:ListSavedSearch

    • log:ListDashboard

    • log:ListDomains

    • log:GetSqlInstance

    • log:ListTagResources

    • log:GetLogging

    • log:CreateLogStore

    • log:CreateIndex

    • log:UpdateIndex

    • log:CreateDashboard

    • log:UpdateDashboard

    • log:GetLogStore

    • log:UpdateLogStore

    • log:UpdateLogging

    • log:GetLogStoreLogs

Project parameters

Parameter

Description

Region

Select an Alibaba Cloud region based on the location of your log sources. After a project is created, you cannot change its region, and SLS does not support cross-region project migration. If you want to collect logs from ECS instances, we recommend that you select the same region as the ECS instances. This configuration enables log collection over the Alibaba Cloud internal network for faster performance.

Project name

The project name must be globally unique within an Alibaba Cloud region and cannot be changed after creation.

Project recycle bin

For projects that contain important data, we recommend that you enable the recycle bin feature to prevent accidental deletion. When enabled, deleted projects move to the recycle bin, where they become inactive and cannot be read from or written to. You can quickly restore a project from the recycle bin if needed. You are charged only for the data storage of projects in the recycle bin.

Description

Enter a description for the project. It can contain up to 64 characters and cannot contain angle brackets (<>), apostrophes ('), backslashes (\), double quotation marks ("), or double backslashes (\\).

Resource group

  • A resource group is a container for centrally managing a set of related resources under a single Alibaba Cloud account.

  • A resource can belong to only one resource group.

  • You can map resource groups to concepts such as projects, applications, or organizations based on your business needs.

Enable service logs

When you enable service logs, a corresponding LogStore and dashboard are created in the storage location you select. The LogStore for operation logs is billed as a standard LogStore, while the LogStores for other logs are free of charge.

  • Detailed logs: Complete operation logs, billed on a pay-as-you-go basis.

  • Important logs: Includes metering logs, consumer group latency logs, and Logtail heartbeat logs. Free of charge.

  • Task operational logs: Includes operational logs for data import tasks, scheduled SQL jobs, and shipping tasks. Free of charge.

Log storage location

A project named log-service-{user-ID}-{region} is automatically created. We recommend that you save all logs from the same region to this project.

Create a project

You can create a project to manage all logs and related log sources for a specific application.

Console

  1. Sign in to the Simple Log Service (SLS) console. In the Projects section, click Create Project.

  2. Configure the project:

    1. Region: Select an Alibaba Cloud region based on the location of your log sources. After a project is created, you cannot change its region, and SLS does not support cross-region project migration. If you want to collect logs from ECS instances, we recommend that you select the same region as the ECS instances. This configuration enables log collection over the Alibaba Cloud internal network for faster performance.

    2. Project name: The project name must be globally unique within an Alibaba Cloud region and cannot be changed after creation.

    3. Leave the other settings at their default values.

API

CreateProject.

Error ProjectAlreadyExist received, but the project is not visible in the console

  • Cause: A project name must be globally unique within an Alibaba Cloud region. If you cannot see the project under your account, another Alibaba Cloud account likely owns it.

  • Recommended action: Due to the resource isolation mechanism of Alibaba Cloud, you cannot view or delete a project under another account. Use a different, unique name for your project and try creating it again.

Identify project source

SLS may automatically create a project when integrated with other Alibaba Cloud services. If you have many projects, you may want to trace their origins, understand the data they store, and review associated costs.

  1. Sign in to the Simple Log Service (SLS) console and find the target project in the project list.

  2. Check the service icon or the Description column to identify the source of the project:

    • If an icon appears before the project name, hover over the icon to view the name of the associated cloud service.

    • If the Description column contains text, it describes the source of the project.

    • If neither of the above is true, a user manually created the project.

  3. Types of automatically created projects

    Some projects are automatically created by the system or other Alibaba Cloud services to support specific features. These projects typically follow fixed naming conventions and have dedicated purposes. Common types include:

    • Cloud Monitor Service (CMS) metadata project: CMS 2.0 automatically creates these projects, which are named in the format aliyun-metadata-{user-ID}-{region-ID}, to store CMS metadata. These projects are free of charge. If you need to delete them, you can only do so by running a command in CloudShell, as console operations may be restricted.

    • Projects automatically created by other cloud services:

      • Application Real-Time Monitoring Service (ARMS): Automatically creates a project to store trace data.

      • ActionTrail: Automatically creates a project to store operation logs.

      • Log Audit Service: Automatically creates regional or centralized projects for centralized log management.

  4. After you identify the cloud service associated with a project, see Collect logs from Alibaba Cloud services for more information, such as the data stored in the project.

    • Determine if a project is in use: Check whether associated cloud services, such as Cloud Firewall or Web Application Firewall (WAF), are still running. If the project's basic information shows no data and there are no Logtail configurations, it might not be in active use. However, before deletion, always confirm that the corresponding cloud service no longer requires SLS. If the associated cloud service is still in use, we do not recommend deleting the project that the service automatically created.

  5. To analyze a project's resource usage and billing, see Analyze resource usage with CloudLens for SLS.

Enable project deletion protection

For projects that contain important data, we recommend that you enable the recycle bin feature to prevent accidental deletion. When enabled, deleted projects move to the recycle bin, where they become inactive and cannot be read from or written to. You can quickly restore a project from the recycle bin if needed. You are charged only for the data storage of projects in the recycle bin.

Note

By default, a project remains in the recycle bin for 7 days. After this period, the system automatically deletes it.

Console

Enable the recycle bin feature

  1. Sign in to the Simple Log Service (SLS) console. In the Projects section, click the target project.

  2. On the project overview page, in the Basic Information section, find Project recycle bin and click Enable if it is not already enabled.

API

Set the recycleBinEnabled parameter in the UpdateProject operation.

Delete and restore projects

Deleting a project may result in data loss from its LogStore, MetricStore, or EventStore. Before you proceed, ensure that the data is no longer needed or you have backed it up.

Note

You are still charged for resources such as storage on the day you delete a Project. Billing stops on the next day. This means that you will not receive a bill from Simple Log Service (SLS) on the third day after you delete the Project.

Console

  1. Pre-deletion cleanup

    • No associated resources:

      • When you enable log analysis for various Alibaba Cloud services such as elastic computing, storage, security, and databases, SLS automatically creates a corresponding project and LogStore in the console. If you no longer need the logs from a cloud service, you must disable the log analysis feature in the console of that service. Ensure the project is not associated with other Alibaba Cloud services.

    • No billing dependencies: If the project is associated with a paid plan, such as a storage package or reserved capacity, you must first unsubscribe from or release the resources.

  2. Procedure

    • Back up important data (optional)

      • LogStore data backup: If the project contains log data that you need to retain, use the SLS Download logs feature to export it beforehand.

      • Configuration backup: Record key settings such as the project name, storage capacity, and access control policies to prevent information loss after deletion.

    • Delete the project

      • In the project list, find the project that you want to delete and click Delete in the Actions column.

        Troubleshoot the ProjectDeletionNotAllowed error

        • Symptom: When you try to delete a project, the system returns the ProjectDeletionNotAllowed error.

        • Cause: The project has deletion protection enabled. Deletion protection is a security feature that prevents accidental deletion of a project. When enabled, you cannot delete the project directly from the console or by using the API.

        • Solution: You must first disable deletion protection before you can delete the project.

          • Sign in to the SLS console and click the target project in the project list. On the project overview page, find the deletion protection switch in the Basic Information section and turn it off.

      • In the Delete Project panel, enter the project name, select a reason for deletion, and then click OK.

        Warning

        After a project is deleted, all its log data and configuration information are permanently deleted and cannot be recovered. Confirm your action carefully before you delete a project to prevent data loss.

      • Confirm the operation: Read the prompt and enter the project name for a second confirmation.

  3. If the recycle bin feature is enabled for the project, you can find the deleted project in the Recycle Bin Projects tab of the project list. By default, a project remains in the recycle bin for 7 days, during which you can restore or permanently delete it.

  4. Confirm the deletion status

    • Deletion is an asynchronous operation. After you submit a deletion request, the system gradually cleans up the project in the background. If you try to delete the same project again and receive a "Project does not exist" message, it usually means the project has been successfully deleted.

    • Go to the SLS console and check if the target project has disappeared from the project list. If the list is empty, all project resources in that region have been cleared.

    • If you have enabled the recycle bin, also check the Recycle Bin Projects list to confirm if the project was permanently deleted or restored.

API

DeleteProject.

Manage resource quotas

If your resource quotas are insufficient, you can adjust various quota metrics for your project based on your needs, including the maximum number of LogStores, shards, Logtail configurations, and machine groups.

You can create a maximum of 150 projects under an Alibaba Cloud account. If you require a higher limit, submit a ticket.

Console

  1. Sign in to the Simple Log Service (SLS) console. In the Projects section, click the target project.

  2. On the project overview page, go to the Basic Information section, find Resource quotas, and click Manage. In the Resource Quotas panel, adjust the quota for the target resource and click Save to submit your request. The change takes about one hour to take effect.

Supported quota metrics

Quota metric

Description

Default

Adjustable limit

Maximum LogStores

The maximum number of LogStores that you can create in a project.

200

400

Maximum shards

The maximum number of shards that you can create in a project.

400

800

Maximum Logtail configurations

The maximum number of Logtail configurations that you can create in a project.

200

400

Maximum machine groups

The maximum number of machine groups that you can create in a project.

200

400

Maximum dashboards

The maximum number of dashboards that you can create in a project.

100

400

Maximum charts per dashboard

The maximum number of charts that a dashboard can contain.

200

400

Maximum saved searches

The maximum number of saved searches that you can create in a project.

100

400

Maximum export tasks

The maximum number of export tasks that you can create in a project.

100

400

Maximum import tasks

The maximum number of import tasks that you can create in a project.

100

400

Maximum scheduled SQL jobs

The maximum number of scheduled SQL jobs that you can create in a project.

100

400

Maximum transformation jobs

The maximum number of transformation jobs that you can create in a project.

100

400

Maximum alerts

The maximum number of alerts that you can create in a project.

100

400

Maximum subscription tasks

The maximum number of subscription tasks that you can create in a project.

100

400

Maximum write traffic per project (GB/min)

The total write traffic of all LogStores in a project within one minute.

100

200

Maximum writes per project (10,000/min)

The total number of write operations across all LogStores in a project within one minute.

60

200

Maximum reads per project (10,000/min)

The total number of read operations across all LogStores in a project within one minute.

60

200

Accelerate cross-region log transfer

For long-distance log transfers, such as writing logs from a region outside the Chinese mainland to one within, you can enable the transfer acceleration feature. This feature uses a globally distributed network of data centers to route user requests to the nearest access point through intelligent routing. It significantly improves access speed with an optimized network and protocols. You are billed for transfer acceleration based on the amount of data transferred.

Console

Enable transfer acceleration

  1. Sign in to the Simple Log Service (SLS) console. In the Projects section, click the target project.

  2. On the project overview page, go to the Endpoints section, find Acceleration endpoint, and click Enable. Read the message in the dialog box and then click Modify.

  3. After you enable transfer acceleration, the transfer speed is improved when you use Logtail for log collection and when you run data transformation jobs.

API

  1. First, call the PutProjectTransferAcceleration operation.

  2. To use the acceleration feature, you must set the endpoint to the acceleration endpoint. Acceleration endpoints support API access only over HTTP and HTTPS, and do not support protocols such as Kafka or gRPC. In scenarios where transfer acceleration is not required, we recommend using a standard service endpoint to reduce transfer costs.

        /**
             * This example gets the AccessKey ID and AccessKey secret from environment variables.
             */String accessId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
            String accessKey = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
            /**
             * The service endpoint for Simple Log Service. Use an acceleration endpoint.
             */String endpoint = "log-global.aliyuncs.com";
            /**
             * Create a Simple Log Service client.
             */static Client client = new Client(host, accessId, accessKey);

Group resources

When you need to group projects, you can use tags or resource groups to categorize them. Use tags for management at the project level and resource groups for management at the Alibaba Cloud account level.

Set resource group

A project can belong to only one resource group.

Console

  1. Sign in to the Simple Log Service (SLS) console. In the Projects section, click the target project.

  2. On the project overview page, in the Resource group details section, hover over the Resource group ID, click Modify, and then select a resource group.

API

ChangeResourceGroup.

Set tags

Console

  1. Sign in to the Simple Log Service (SLS) console. In the Projects section, click the target project.

  2. On the project overview page, in the Tags section, click Edit, and then set tags in the Edit tag panel.

API

TagResources.

View endpoints and set a custom domain

You can view endpoint information or replace a public endpoint with a custom domain. After the configuration is complete, you can use the corresponding domain as the endpoint in API calls.

Console

  1. Sign in to the Simple Log Service (SLS) console. In the Projects section, click the target project.

  2. On the project overview page, go to the Endpoints section to view the endpoint information for the current project.

  3. On the project overview page, in the Basic Information section, hover over Custom domain, click Set. In the Specify Custom Endpoint panel, configure the domain name, and then click Bind.

  4. In the Alibaba Cloud DNS console, add a CNAME record to activate the domain binding. Set the Record Value to the Public Endpoint listed in the Endpoints section on the project overview page. For detailed instructions, see CNAME record.

API

CreateDomain.

Bind an SSL certificate to a custom domain

  • Current behavior: The SLS console does not support uploading or binding SSL certificates directly to a custom domain.

  • Solutions:

    • Option 1 (Recommended): Use Alibaba Cloud CDN. Use Alibaba Cloud CDN to accelerate the SLS endpoint, bind an SSL certificate in the CDN console, and then access SLS through CDN.

    • Option 2 (Default): Use the default SLS endpoint. The built-in SLS default endpoint supports HTTPS with a built-in SSL certificate. In most cases, you can use it without extra configuration.

Monitor and maintain projects

Use the service log feature to obtain resource operation logs (create, modify, update, delete) and task execution logs (scheduled SQL, data import, data shipping) within a project. You can also get consumer group consumption latency logs from a LogStore, as well as error, heartbeat, and statistics logs from Logtail.

Console

  1. Sign in to the Simple Log Service (SLS) console. In the Projects section, click the target project.

  2. On the Service log page of the project, click Enable Detailed Logs. In the Modify service log settings panel, select the service logs you want to enable and the project where they will be stored.

    • Detailed logs: Provides complete operation logs. This is a pay-as-you-go feature.

    • Important logs: Provides metering logs, consumer group latency logs, and Logtail heartbeat logs. This feature is free of charge.

    • Task operational logs: Provides the operational logs of data import tasks, scheduled SQL jobs, and shipping tasks. This feature is free of charge.

    • Log storage location: Choose an existing project or let the system automatically create a new one to store these logs.

Limits and compatibility

  • Bulk deletion limit: SLS does not currently provide a tool for bulk deletion of projects or LogStores. You must delete them one by one manually.

  • Mobile access: You can access the SLS console through a mobile browser to sign in and manage projects, including creating, modifying, and deleting them.

  • Project not visible after creation: If a newly created project does not appear in the list, check that you have selected the correct region and try refreshing the page.

More information

To store different types of data in a project, you must create different types of stores. For more information, see Manage stores.