VictoriaLogs

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
ECS	Elastic Container Service	AWS 容器编排服务
HA	High Availability	高可用
HTTP	Hypertext Transfer Protocol	超文本传输协议
JSON	JavaScript Object Notation	一种结构化数据格式
mTLS	Mutual Transport Layer Security	双向 TLS，通信双方都验证证书
OTLP	OpenTelemetry Protocol	OpenTelemetry 遥测传输协议
SIEM	Security Information and Event Management	安全信息与事件管理
TLS	Transport Layer Security	传输层安全协议
UI	User Interface	用户界面

Links#

https://docs.victoriametrics.com/victorialogs/
https://docs.victoriametrics.com/victorialogs/quickstart/
https://docs.victoriametrics.com/victorialogs/querying/
https://docs.victoriametrics.com/victorialogs/data-ingestion/
https://docs.victoriametrics.com/victorialogs/security-and-lb/
https://docs.victoriametrics.com/victorialogs/metrics/
https://docs.victoriametrics.com/victorialogs/cluster/

1. Important Points#

VictoriaLogs 是 VictoriaMetrics 体系里的 log store，主打高吞吐、低资源占用、查询体验直接。它适合把应用日志、平台日志和审计日志集中到一个可查询的日志系统里。

VictoriaLogs 存储日志，stream fields 使用稳定低基数维度；request_id 等高基数字段保留为日志字段查询。

适合:
    application stdout/stderr logs
    platform logs / ECS logs / host logs
    log search and incident investigation
    high-volume append-only log storage
    simple operational model with HTTP ingestion and LogSQL query

不适合:
    想直接替代完整 SIEM 的场景
    不愿意自己管 auth / TLS / retention / routing
    需要复杂规则引擎但又不想加代理层

核心原则:
    private network first
    access control should be explicit
    UI and query path should use the same protected entrypoint
    logs should carry stable stream fields like service / env / cluster
    high-cardinality fields should be controlled at ingestion time

2. Main Surfaces#

Surface	Purpose	Notes
Ingestion	receive logs	JSON line, Elasticsearch bulk, Loki JSON, OTLP, syslog, collectors
Query	search logs	LogSQL at `/select/logsql/query`
UI	browse logs	Web UI at `/select/vmui/`
Access Control	protect ingestion/query	Basic Auth, vmauth, mTLS in enterprise deployments
Scaling	multi-node / HA	cluster or replicated single-node setups

3. Files In This Section#

Access and auth:
    Access.md

Deployment / local setup:
    Setup.md

TLS:
    TLS.md

Alerting:
    Alerting.md

ECS collection scenario:
    ECS.md