Log service migration guide

Access the console

1. Log on to the Simple Log Service console.

2. In the Projects section, click the project you want.

Index field and tokenizer settings

1. On the Logstores tab, click the target Logstore, and choose > Search & Analysis.

2. On the Search & Analysis page, click Index Attributes or Attributes in the upper-right corner, and check whether the Field Name, Type, Delimiter, and Enable Analytics configurations are consistent with the old Logstore. For fields that differ, add, delete, or modify them accordingly, and then save the configuration. For more information, see Index-based query and analysis.

Log Public IP settings

1. On the Logstores tab, click the target Logstore, and choose > Modify.

2. On the Basic Information page, if the Log Public IP feature is enabled for the old Logstore, you need to apply the same configuration to the new Logstore. For more information, see Manage Logstores.

WebTracking write address update

In your frontend SDK or JavaScript collection code, locate the Logstore parameter of the WebTracking configuration and replace it with the new Logstore name. After you deploy the code, verify that the new Logstore receives data as expected. For more information, see Data collection.

Data encryption configuration

1. On the Logstores tab, click the target Logstore, and choose > Modify.

2. On the Encryption Configuration page, if data encryption is configured for the old Logstore, you need to apply the same configuration to the new Logstore. For more information, see Encryption of data in transit.

LogReduce

1. On the Logstores tab, click the target Logstore, and choose > Search & Analysis.

2. On the Search & Analysis page, click Index Attributes or Attributes in the upper-right corner, and then turn on the LogReduce switch. For more information, see LogReduce.

Dashboard and alert configuration

• Dashboard: After you select the target Project, add a dashboard on the > Dashboard > Dashboards page. For more information, see Quick start: Create a dashboard.

• Alert Rules: After you select the target Project, create an alert rule on the > Alerts > Alert Center page. For more information, see Alerting.

Data consumption update

If data consumption was configured for the old Logstore, you need to update the consumer configuration to point to the new Logstore. For more information, see Overview of real-time consumption.

OpenAPI or SDK calls

• Changes to the log reading API
  If you read logs using OpenAPI or an SDK, such as the GetLogs API, you must update the Logstore name parameter in your code. For more information, see Use GetLogs to query logs.
  

• Disabling Simple Log Service by calling ModifyUserWafLogStatus
  After you call the ModifyUserWafLogStatus API to disable the service, the system response depends on the migration stage:
  

  • Before migration
    The system deletes the old Logstore, which is named in the format wafnew-project-<Alibaba Cloud account ID>-<region>. Billing for Simple Log Service stops immediately.
    

  • During migration (dual Logstores)
    The system deletes both Logstores. The Simple Log Service for the WAF on-demand instance remains enabled. To stop billing completely, go to the Detection and Response > Log Service page and click Downgrade Capacity to decrease the quota. If you do not do this, billing resumes after the parallel migration period ends.
    

  • After activation or migration
    The system deletes the new Logstore, which is named in the format wafng-project-<Alibaba Cloud account ID>-<region>. The Simple Log Service for the WAF on-demand instance remains enabled. To stop billing completely, go to the Detection and Response > Log Service page and click Downgrade Capacity to decrease the quota. Otherwise, normal billing continues.
    

Can I skip the migration?

If you confirm that none of the configuration items described in this document require manual migration, you do not need to perform the migration. Wait for the parallel operation period to end and use the new Logstore directly.

If configuration items that require manual migration exist, you must complete the migration as described in this document. Otherwise, issues such as new logs not being indexed or queried correctly may occur after the parallel operation period ends, which may affect your business.

How do I verify the migration?

1. Data consistency verification: Switch to the new Logstore, run your commonly used query statements, and confirm that the results are consistent with the old Logstore.

2. Associated feature testing: If you have configured dashboards, alert rules, or data consumption, test each feature to verify that it works as expected.

3. What to do next: After the verification succeeds, you can use the new Logstore for all subsequent operations. The old Logstore automatically stops receiving data after the 180-day parallel operation period ends.

Will protection features or log collection be interrupted during the migration?

No. During the migration, the old and new Logstores continue to receive writes in parallel. Existing protection features and log collection services are not affected.

Is it normal to see two copies of data in the Simple Log Service console during the parallel operation period?

Yes, this is normal. During the parallel operation period, both the old and new Logstores store their own copy of data. The old Logstore automatically stops receiving data after 180 days.

What should I do if high-risk configurations or special scenarios cause exceptions?

If high-risk configurations such as indexes and tokenizers cause query exceptions after the migration, or if other special custom scenarios exist, contact technical support through the DingTalk security service group or your business manager.