Call the ModifyRule API to change the collection configuration.

Usage instructions

Changing the project or log topic linked to the collection configuration is not supported.

After you create a collection configuration, LogCollector parses and collects logs from the specified directory according to defined rules, and stores them in TLS. If parameters such as log path or log type change, you should update the collection rules promptly.

This API is limited to 20 requests per second. Exceeding the limit will trigger the ExceedQPSLimit error.

Advanced parameters are used for extended configuration. Once extended configuration is enabled, you can customize advanced LogCollector behaviors, such as when to release file handles.

Request instructions

Request method: PUT

Request URL: https://{tls-endpoint}/ModifyRule

Request parameters

The table below lists only the unique request parameters for this interface and some common parameters. For more information, see Common parameters.

Body

Parameter	Type	Required	Example value	Description
RuleId	String	Yes	fa******	ID of the collection configuration.
RuleName	String	No	testname	Name of the collection configuration. Refer to resource naming rules for naming conventions. Unique within a log topic.
Paths	Array of String	No	/	Collection path list. You can create up to 10 collection paths. The collection path must be specified as an absolute path; relative paths are not supported yet. When InputType is 0 or InputType is 2: The collection path supports both exact matches and wildcard pattern matching. Wildcards only support *,、?, but only one ** wildcard can be configured at most. When InputType is 1: No need to configure a collection path list.
LogType	String	No	delimiter_log	Collection mode. minimalist_log: Single-line full text mode. json_log: JSON mode. delimiter_log: separator mode. multiline_log: multiline full content mode. fullregex_log: full regular expression mode.
ExtractRule	Object of ExtractRule	No	/	Log extraction rules. If you configure log types other than minimalist_log or json_log for collection, you must also set extraction rules.
ExcludePaths	Array of ExcludePath	No	/	Collection denylist. You can create up to 10 collection denylist entries. When InputType=0 or InputType=2: When Type is Path, Value represents a directory. Supports exact match and wildcard pattern match; wildcards are limited to “、?, does not support * wildcard. When Type is File, Value represents a file name. Supports exact match and wildcard pattern match; wildcards are limited to *,、?, but only one ** wildcard can be configured at most. When InputType=1: Blacklist configuration for collection is not allowed.
LogSample	String	No	/	Log sample. The log sample can contain up to 3000 characters. The log sample content must match the collection pattern. Single-line full-text mode and JSON mode do not require log samples Other modes must include log samples, and the sample content must match the data collection mode
UserDefineRule	Object of UserDefineRule	No	/	User-defined collection rules.
InputType	Integer	No	2	Collection type. 0: Host log file. 1: K8s container standard output. 2: K8s container internal log file.
ContainerRule	Object of ContainerRule	No	/	Container collection rules.
Pause	Integer	No	1	Pause log collection configuration. 1: Pause log collection configuration. 0: Do not pause log collection configuration.

ExtractRule

Parameter	Type	Required	Example value	Description
Keys	Array of String	No	[ "time", "", "level", "msg" ]	List of log field names (Key). Valid only when LogType is delimiter_log or fullregex_log You can configure up to 100 field names. When LogType is delimiter_log, duplicate field names are not allowed, and not all field names can be left blank. When LogType is fullregex_log, duplicate field names are not allowed, and a field name cannot be left blank.
Quote	String	No	"	Quotation mark Content enclosed by quotation marks is parsed as a complete field and not split. Valid only when LogType is set to delimiter_log.
TimeKey	String	No	request_time	Name of the log timestamp field. If you use a specified time field from the log as the log timestamp, you need to provide the TimeKey and TimeFormat fields. TimeKey and TimeFormat must be provided together.
LogRegex	String	No	[(\d+-\d+-\w+:\d+:\d+,\d+)]\s[(\w+)]\s(.*)	The entire log must match the regular expression. This is valid only when the collected log type is fullregex_log. The expression must be valid.
TimeZone	String	No	GMT+08:00	Time zone; supports host time zone (default) and custom time zone. The custom time zone supports GMT and UTC. GMT format: GMT+08:00. UTC format: Asia/Shanghai.
Delimiter	String	No	#	Log separator. Effective only when LogType is delimiter_log.
BeginRegex	String	No	[(\d+-\d+-\w+:\d+:\d+,\d+)]\s[(\w+)]\s(.*)	Regular expression required for the first line of the log. Effective only when LogType is set to multiline_log or fullregex_log. Must be a valid regular expression.
TimeFormat	String	No	%Y-%m-%dT%H:%M:%S,%f	Parsing format of the time field If you use the specified time field in the log as the log timestamp, you need to enter both TimeKey and TimeFormat TimeKey and TimeFormat must be provided together For details on how to configure the time format, see Time format
LogTemplate	Object of LogTemplate	No	{ "Type": "Nginx", "Format": "format main '$remote_addr - $remote_user [$time_local] \"$request\" $request_time $request_length $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';" }	Automatically extract log fields based on the specified log template.
UnMatchLogKey	String	No	LogParseFailed	When uploading logs that fail to parse, this is the key name for the logs with parsing errors. UnMatchUpLoadSwitch=true and UnMatchLogKey must appear together.
FilterKeyRegex	Array of FilterKeyRegex	No	/	Filter rule list. When LogType is minimalist_log or multiline_log, you can configure up to one filter rule, and the filter field key must be content. When LogType is delimiter_log, json_log, or fullregex_log, you can configure up to five filter rules. The filter field keys must not be duplicated or left blank. The regular expression to match the log content in the filter field must be valid and no longer than 256 characters.
TimeExtractRegex	String	No	[0-9]{0,2}\/[0-9a-zA-Z]+\/[0-9:,]+	Regular expression for extracting time, used to extract and parse time values from the TimeKey field as the collection time.
UnMatchUpLoadSwitch	Boolean	No	true	Upload logs that failed to parse. UnMatchUpLoadSwitch=true and UnMatchLogKey must be used together. true: Upload logs that failed to parse. false: Do not upload logs that failed to parse.
EnableNanosecond	Boolean	No	true	Enable nanosecond precision time. When enabled, log timestamps are parsed and reported with nanosecond precision. true: Enable nanosecond precision time. false: Disable nanosecond precision time.
TimeSample	String	No	2006-01-02T15:04:05Z07:00	Time sample. Used to verify whether the entered time parsing format is correct.

ExcludePath

Parameter	Type	Required	Example value	Description
Type	String	No	Path	Collection path type File: Filename Path: Directory
Value	String	No	/accesslog	Collection path. Must specify an absolute path. When Type is Path, the Value refers to a directory. When Type is File, the Value refers to a file name.

UserDefineRule

Parameter	Type	Required	Example value	Description
Fields	JSON Map	No	{"ClusterID":"dabaad5f-7a10-4771-b3ea-d821f73e****"}	Add constant fields to logs. Constant fields must follow these restrictions: Supports uploading up to 5 constant fields. Field names (keys) must be unique and non-empty. The length must be between 1 and 128 characters, including English letters, digits, and special characters (-_./), and can not start with an underscore. Field values can not be empty and can be up to 512 KiB in size.
Plugin	Object of Plugin	No	{"processors":[{"json":{"field":"__content__","trim_keys":{"mode":"all","chars":"#"},"trim_values":{"mode":"all","chars":"#"},"allow_overwrite_keys":true,"allow_empty_values":true}	LogCollector plugin configuration. Once plugin configuration is enabled, you can add one or more LogCollector processor plugins to parse logs with complex or varying structures.
Advanced	Object of Advanced	No	{ "CloseInactive": 10 }	LogCollector Extended configuration.
RawLogKey	String	No	__raw__	Original log field name. This is only effective when EnableRawLog is set to true. RawLogKey defaults to __raw__, which means the original log data will be encapsulated in the __raw__ field and uploaded to TLS along with the parsed log data.
TailFiles	Boolean	No	true	LogCollector collection policy specifies whether LogCollector collects incremental logs or full logs. The default value is false, indicating collection of full logs. true: incremental collection. When LogCollector collects logs, it only collects newly added content within the file. When new logs are written to monitored log files, it triggers LogCollector collection. For first-time collected log files, LogCollector automatically determines the collection position based on the incremental threshold you set at TailSizeKb. If the new file size does not exceed your specified incremental threshold, the first collection starts from the beginning of the new file. If the new file size exceeds your specified incremental threshold, the first collection starts at the position where the file ends minus the incremental threshold. That is to say, only incremental logs are collected. For log files that are not being collected for the first time, LogCollector uses the Checkpoint to determine the collection position and continues collecting. false: (Default) Collect all logs. LogCollector starts collecting logs from the beginning of each document, collecting historical log data.
HostnameKey	String	No	hostname	hostname field name. Required only when EnableHostname is set to true.
EnableRawLog	Boolean	No	true	Choose whether to upload the original log. true: Upload the original log. false: (Default) Do not upload the original log.
ShardHashKey	Object of ShardHashKey	No	{ "HashKey": "3C" }	Rule for routing log shard. If this parameter is not set, the default load balancing mode is used to write logs, and packets are written to any available shard. When this parameter is set, logs are collected using the HashKey routing shard mode, so TLS will write data to the shard containing the specified key value.
ParsePathRule	Object of ParsePathRule	No	{ "PathSample": "/data/nginx/log/dabaad5f-7a10/tls/app.log", "Regex": "\\/data\\/nginx\\/log\\/(\\w+)-(\\w+)\\/tls\\/app\\.log", "Keys": ["instance-id", "pod-name"] }	Rules for parsing the collection path. After setting the rule, fields in the collection path will be extracted using the regular expression specified in the rule and added as metadata to the log data. tip When collecting container standard output, this parameter is not supported.
EnableHostname	Boolean	No	true	You can choose whether to upload the hostname field. By default, it is disabled. true: add a field in the original log to record the hostname of log source. You should specify the hostname field name using HostnameKey at this time. false: (default) Do not add the hostname field.
HostGroupLabelKey	String	No	host_group_label	Field name used to store host group label information.
EnableHostGroupLabel	Boolean	No	true	You can select whether to upload the label information of the host group to TLS. By default, it is disabled. true: LogCollector will upload the label information of the host group to the specified field. You can specify the field name in the HostGroupLabelKey parameter. false (default): Do not upload the label information of the host group.
TailSizeKb	Integer	No	1024	Incremental collection rollback threshold, measured in KiB. When the LogCollector collection strategy is incremental, for the initial collection of log files: If the size of the new log file does not exceed the value of TailSizeKb, the collection starts from the beginning of the new log file. If the size of the new log file exceeds the value of TailSizeKb, the collection starts from the position where the end of the new log file minus TailSizeKb.
IgnoreOlder	Integer	No	7	Ignore log files that haven't been updated for a certain period; the unit is hours.
MultiCollectsType	String	No	RuleID	Allow collecting log files multiple times. Empty: Use the log file ID (including file inode, device, and checksum of the first N bytes) to uniquely identify the log file. RuleID: Use the collection rule ID and log file ID to uniquely identify the log file. TopicIDRuleName: Use the log topic ID, collection rule name, and log file ID to uniquely identify the log file.

ContainerRule

Parameter	Category	Required	Example value	Description
EnvTag	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	This button determines whether to set environment label as log tag and add it to raw log data. If enabled, TLS will add related container environment variable fields to the logs. If you set multiple key-value pairs, it means you add multiple fields. For example, set the Key to source and the Value to data_source. If the container includes the environment variable source=DC, a new field __tag__data_source__: DC will be added to the log.
Stream	String	No	all	Collect information. stdout: Collect container standard output (stdout). stderr: Collect container standard error (stderr). all: Collect both container standard output (stdout) and standard error (stderr) simultaneously.
KubernetesRule	Object of KubernetesRule	No	{ "NamespaceNameRegex": ".test.", "WorkloadType": "Deployment", "WorkloadNameRegex": ".test.", "IncludePodLabelRegex": { "Key1": "Value1", "Key2": "Value2" }, "ExcludePodLabelRegex": { "Key1": "Value1", "Key2": "Value2" }, "PodNameRegex": ".test.", "LabelTag": { "Key1": "Value1", "Key2": "Value2" } }	Collection rules for Kubernetes containers.
ContainerNameRegex	String	No	.test.	Name of container to collect. If the container name is not specified, all containers in the host group will be collected. Supports regex matching. For example, if you set container name to ^(container-test)$, all containers named container-test are collected.
ExcludeContainerEnvRegex	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	The container environment variable denylist specifies which containers are excluded from data collection. If the denylist is disabled, all containers will be collected. If you enable the container environment variable denylist, Key is required, while Value is optional. If Value is empty, all containers whose environment variables contain the Key will be excluded from collection. If Value is not empty, only containers whose environment variables match both the Key and Value are excluded. Value supports regular expressions. For example, set Key to module and Value to ^(tcp\|udp)$. In this case, containers with environment variables module:tcp or module:udp will be excluded from collection. The logical relationship between multiple Key-Value pairs is OR. As long as a container's environment variables match any pair, the container will be excluded from collection. When enabling the container environment variable denylist, Keys must not be duplicated.
IncludeContainerEnvRegex	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	Specify which containers to collect by using the container environment variable allowlist. If the allowlist is not enabled, all containers will be collected. To enable the container environment variable allowlist, enter key-value pairs. Key is required; value is optional. If Value is empty, all containers containing the Key in their environment variables will be collected. If Value is not empty, only containers with the Key in their environment variables and matching the Value will be collected. Value supports regular expression matching. For example, set Key to module and Value to ^(tcp\|udp)$ to collect only containers with environment variable module:tcp or module:udp. The logic between multiple key-value pairs is OR. Any container environment variable that matches one of the key-value pairs will be included in the collection. When the container environment variable allowlist is enabled, Keys can not be duplicated.
ExcludeContainerLabelRegex	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	The container label denylist is used to specify which containers should not be collected. If the denylist is disabled, all containers are collected. If the container label denylist is enabled, the Key field is required and the Value field is optional. If Value is empty, containers with the specified Key in their label will not be collected. If Value is not empty, only containers whose labels match both the Key and Value are excluded from collection. Value supports regular expressions. For example, set Key as app and Value as ^(test1\|test2)$ to exclude containers with the labels app:test1 and app:test2 from collection. The logical relationship between multiple Key-Value pairs is OR. If a container label matches any Key-Value pair, the container will be excluded from collection. When the container label denylist is enabled, the Key fields must not be duplicated.
IncludeContainerLabelRegex	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	You can specify which containers to collect using container label allowlists. When the allowlist is not enabled, all containers will be collected. When enabling the container label allowlist, you need to fill in key-value pairs. Key is required; value is optional. Value is empty: Collect all containers that contain the key in their container label. When Value is not empty: Only collect containers whose Label contains the Key and whose value matches the Value. Value supports regular expression matching. For example, set Key to app and set Value to ^(test1\|test2)$. Only containers with app:test1 or app:test2 in the container Label will be collected. The logical relationship between multiple Key-Value pairs is OR. Any container Label that matches any Key-Value pair will be included in the collection. When enabling the container Label allowlist, keys cannot be duplicated.

LogTemplate

Parameter	Type	Required	Example value	Description
Type	String	No	Nginx	Type of log template. Supported types: Nginx: Log template for Nginx.
Format	String	No	log_format main '$remote_addr - $remote_user [$time_local] "$request" $request_time $request_length $status $body_bytes_sent "$http_referer" "$http_user_agent"';	Format of the log template.

FilterKeyRegex

Parameter	Type	Required	Example value	Description
Key	String	No	__content__	Name of the filter field.
Regex	String	No	.ERROR.	Regular expression that the log content of the filter field must match.

Plugin

Parameter	Type	Required	Example value	Description
processors	Array of JSON Map	No	{ "processors":[ { "json":{ "field":"__content__", "trim_keys":{ "mode":"all", "chars":"#" }, "trim_values":{ "mode":"all", "chars":"#" }, "allow_overwrite_keys":true, "allow_empty_values":true } } ] }	LogCollector plugin. For the list of supported plugins and parameter details, see LogCollector Plugin Overview.

Advanced

Parameter	Type	Required	Example value	Description
CloseEOF	Boolean	No	true	After reaching the end of the log file, release the handle for that log file. Default is false.
CloseRemoved	Boolean	No	true	Whether to release the file handle after the log file is removed Default is false.
CloseRenamed	Boolean	No	true	After the log file is renamed, release the handle of the log file. The default value is false.
CloseTimeout	Integer	No	1800	Maximum monitoring duration for log files by LogCollector. Measured in seconds. The default is 0 seconds, which means LogCollector will not restrict the monitoring duration for log files. LogCollector starts timing when monitoring a log file. Once the specified duration is exceeded, the log file handle is released immediately and monitoring ends, regardless of whether the log file has been fully read.
CloseInactive	Integer	No	10	Wait time before releasing the log file handle. Release the handle of the log file if no new logs are written over the specified period. Unit: seconds. Allowed values: 1 to 300 seconds. Default is 60 seconds.
NoLineTerminatorEOFMaxTime	Integer	No	5	Maximum wait time when LogCollector does not read a newline character. Measured in seconds; default is 5s. LogCollector starts timing when it begins reading log file contents. If no newline is read within the specified time, it will send the logs in the buffer. If there is a long interval between log writes, a complete log entry may be split and written in two parts. You can adjust this parameter based on the interval between log writes.

ShardHashKey

Parameter	Type	Required	Example value	Description
HashKey	String	No	3C	The HashKey of the log group, used to specify the shard to which the current log group writes. This parameter must be within the range [00000000000000000000000000000000-ffffffffffffffffffffffffffffffff).

ParsePathRule

Parameter	Type	Required	Example value	Description
Keys	Array of String	No	["instance-id","pod-name"]	Field name list. TLS parses the path sample into multiple fields based on regular expressions (Regex). Keys specify the name of each field. You can configure up to 100 field names. Field names can not be empty or duplicated.
Regex	String	No	/var/logs/([a-z])_any_([a-z])/test.log	Regular expression for extracting path fields. It must match the sample collection path; otherwise, extraction fails.
PathSample	String	No	/var/logs/instanceid_any_podname/test.log	Sample collection path from an actual scenario. The collection path sample must be an absolute path. The path sample cannot contain wildcards、?、*。

KubernetesRule

Parameter	Type	Required	Example value	Description
LabelTag	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	This button determines whether to add Kubernetes Labels as log tags to the raw log data. If enabled, TLS will add Kubernetes Pod Label related fields to the logs. If you set multiple key-value pairs, multiple fields are added. For example, set the Key to source and the Value to data_source. Suppose the Pod includes the Label source=DC, a new field __tag__data_source__: DC will be added to the log.
PodNameRegex	String	No	.test.	Pod name specifies the container to be collected. If no Pod name is specified, all containers will be collected. Pod names support regular expressions. For example, set the Pod name to ^(http.*)$ to collect all containers under Pods that start with "http".
WorkloadType	String	No	Deployment	Specify the container for collection based on workload type. Only one type can be selected. If no type is specified, containers of all types are collected. Supported workload types: Deployment: Stateless workload StatefulSet: Stateful workload DaemonSet: Daemon process Job: Task CronJob: Scheduled SQL task
AnnotationTag	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	This button determines whether to set Kubernetes Annotation to log tags and add it into the raw log data. If enabled, TLS will add Kubernetes Pod annotation fields to the logs. If you set multiple key-value pairs, multiple fields are added. If you set the key to "sink" and the value to "data_sink", and the Pod contains the annotation sink=ck, a new field __tag__data_sink__: ck will be added to the log.
WorkloadNameRegex	String	Not supported	.test.	By configuring the workload name, you can specify the container to collect. If no workload name is specified, all containers are collected. Workload names support regular expression matching. For example, if you set the workload name to ^(http.*)$, all containers under workloads starting with http will be collected.
NamespaceNameRegex	String	No	.test.	Name of the Kubernetes namespace to be collected. If no Namespace is specified, all containers will be collected. Namespace names support regular expression matching. For example, setting the namespace name to ^(tcp\|udp)$ means collecting all containers in the tcp and udp namespaces.
ExcludePodLabelRegex	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	Specify containers to exclude from collection using a Pod Label denylist. If disabled, all containers will be collected. If you need to set a Pod Label denylist, the Key field is required, while the Value field is optional. If the Value field is empty, all containers with the specified Key in the Pod Label will be excluded from collection. If the Value field is not empty, only containers with the specified Key and a Value that matches will be excluded from collection. The Value field supports regular expressions. For example, set the Key to module and the Value to ^(tcp\|udp)$ to exclude containers with module:tcp or module:udp in the Pod Label from collection. tip The logical relationship between multiple key-value pairs is logical OR, meaning a Pod Label matching any key-value pair will be excluded from collection. When enabling the Pod Label denylist, keys can not be duplicated. When using fuzzy regular expressions, you must include .. For example, ^(http.)$ matches strings that start with "http".
IncludePodLabelRegex	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	The Pod Label allowlist is used to specify the containers to be collected. If the Pod Label allowlist is not enabled, all containers will be collected. If you need to set the Pod label allowlist, the key field is required. If the value is empty, all containers with the key in the Pod label are collected. If the value is not empty, only containers with the key in the Pod label and a matching value are collected. Regular expressions are supported. The value supports regular expressions. For example, set the key to module and the value to ^(tcp\|udp)$ to collect only containers where Pod label includes module:tcp or module:udp. tip The logic between multiple key-value pairs is OR. The Pod label only needs to match any key-value pair to be included in the collection scope. When enabling the Pod label allowlist, duplicate keys are not allowed. For fuzzy regular expression matches, you must add .. For example, ^(http.)$ matches strings that start with "http".
EnableAllLabelTag	Boolean	No	true	This button determines whether to add all Kubernetes labels as log tags to the raw log data. When enabled, TLS will add all related Kubernetes Pod label fields to logs. For example, if the Pod contains the label source=DC and destination=CS, the log will include the fields __tag__source__: DC and __tag__destination__: CS.
ExcludePodAnnotationRegex	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	Pod Annotation denylist specifies containers that are excluded from collection. If you need to set a Pod Annotation denylist, the Key is required and the Value is optional. If the Value is empty, all containers in Pods with the specified Key in their Pod Annotation will be excluded. If the Value is not empty, only containers in Pods with the specified Key and a Value matching the specified Value in their Pod Annotation will be excluded. By default, Value uses string matching. Containers only match if the value is exactly the same as the value of the Pod annotation. If the value starts with^and ends with$, it uses regular expression matching. For example, set the Key as "app" and set the Value as ^(test1\|test2)$, and then the containers in Pods whose annotation contains app:test1 or app:test2 will match. tip The logical relationship between multiple key-value pairs is logical OR. A Pod Annotation will be included in the collection scope if it matches any key-value pair. When enabling Pod Annotation denylist, duplicate Keys are not allowed. When using regex fuzzy matching, you must add .. For example, ^(http.)$ matches strings that start with "http".
IncludePodAnnotationRegex	JSON Map	No	{ "Key1": "Value1", "Key2": "Value2" }	Pod annotation allowlist is used to specify the containers to be collected. If you need to set a Pod annotation allowlist, the Key field is required and the Value field is optional. If the Value field is empty, all containers in Pods with the specified Key in their annotations will match. If the Value field is not empty, containers in Pods whose annotation contains the Key and the Key's value matches the Value will match. By default, Value uses string matching. Containers only match if the value is exactly the same as the value of the Pod annotation. If the value starts with^and ends with$, it uses regular expression matching. For example, set the Key as "app" and set the Value as ^(test1\|test2)$, and then the containers in Pods whose annotation contains app:test1 or app:test2 will match. tip The logical relationship between multiple Key-Value pairs is logical OR. As long as a Pod Annotation matches any key-value pair, it will be included in the collection scope. When the Pod Annotation allowlist is enabled, the Key must not be duplicated. You must add .* when using regular expression fuzzy matching. For example, ^(http.*)$ matches strings that start with "http".

Return parameters

This API does not have any unique return parameters. For more information, see Return Structure.

Sample request

Taking single-line full text mode as an example.

Sample response

Error Code

The following table lists error codes related to this API and business logic. For common error codes, refer to the Common Error Codes documentation.

HTTP status code	Error Code	Error message	Description
400	InvalidArgument	Invalid argument key %s, value %s, please check argument	Invalid parameter.
400	PathQuotaExceed	Path Quota Exceeded	Exceeded the quota for collection paths.
400	ExcludePathQuotaExceed	Exclude Path Quota Exceeded	Exceeded collect blacklist quota.
400	ExtractRuleKeyQuotaExceed	ExtractRule Key Quota Exceeded	Exceeded the limit for custom fields defined by the extraction rule
400	ExtractRuleFilterKeyRegexQuotaExceed	ExtractRule FilterKeyRegex Quota Exceeded	Exceeded the limit for extraction rule's filter rules.
404	RuleNotExist	Rule %s does not exist	The collection configuration does not exist.
409	RuleAlreadyExist	Rule %s already exist	The collection configuration already exists.
500	InternalServerError	We encountered an unexpected server error, please try again later.	Internal server error.

Torch Log Service