Updated at: 2022-12-09 03:49:50
Click Data Source > Agent > Template Configuration > +New to make the New Template, as follows:
► Basic Configuration:
Field Name Field Description
* Template Name The name of the template
* Agent Type AnyRobot Agent or Filebeat
* Template Type • For the Agent type as AR-Agent, the available template types include: General Input Template, General Input Template, and Winlog Input Template;
• For the Agent type as Filebeat, the available template types include: Filebeat Input Template and Filebeat Output Template.
Note: Through the setting of Winlog Input Template, you can ensure unified aggregation and management of Windows logs by simplifying the original cumbersome deployment and configuration process
► Aggregation Configuration: 
• AnyRobot Agent General Input Template: 
Field Name Field Description
* File Path ► Aggregation: The specified file path for aggregation, such as, 
• /var/log/Apche.txt means to aggregate the specified Apache file;
• /var/log/* means to aggregate all log files in the log folder
► Filter: The specified file path for filtering, such as, /var/log/Ngnix.txt means to filter the specified Ngnix file
* Encoding Format Two encoding formats: Identify Automatically or Input
Note: Only ASC||, BIG5, GB2312, UTF-8 and GBK are available to Identify Automatically
* Log Type The custom type fields for the log data
Log Tag The custom tag fields for the log data
File Handle Limit The upper limit number of file handles, 1000 by default. Upon reaching the upper limit, there will be no more file monitoring.
Note: The file handle is used for file location for the file monitoring. The file handle upper limit setting is to limit the number of file handles occupied by Agent, so as to avoid affecting the use of file handles by other processes due to Agent occupying too many file handles.
File Handle Release It is to set whether to enable the function of file handle release. To enable file handle release, you must set the inactive handle release time threshold (1 day by default). The handle beyond the inactive file handle release time threshold will no longer be occupied, and be automatically released.
Filter Historical Logs • Enabled: The historical data will not be aggregated, and only incremental data will be aggregated;
• Disabled: The full data will be aggregated.
Filter Historical Files • Enabled: The historical log files will be filtered according to the filter period setting;
• Disabled: All historical log files will be aggregated.
Note: Editing is allowed only when creating a new one, and not allowed after creation.
Clear Expired Files • Enabled: The historical log files will be cleared according to the expiration time setting;
• Disabled: Clearing log files will not be allowed.
Note: Once the file is cleared, it cannot be recovered.
* Log Size If a single log exceeds the size limit, it will be filtered.
Note: The maximum size of a single log is 10MB.
Merge Multi-lines ► Enabled: For configuring multi-lines merge rule to perform multi-lines merge for matched data: 
• Multi-lines Merged: If the current line matches the Regular Expression, it will be merged into one line;
• Regular Reversal Expression: If enabled, it means that if the current line does not match the Regular Expression, it will be merged into one line;
• Match Mode: Select the After to merge with the front content, or the Before to merge with the latter content.
► Disabled: The multi-lines will not be merged.
Added Field It is to add custom fields to log data.
• AnyRobot Agent General Output Template: 
Field Name Field Description Restrictive Condition
* Output Address The specified transfer destination of log data -
* Output Type The specified transfer port of log data -
Transfer Protocol The specified log data transfer protocol, including: HTTP, HTTPS, TCP -
Output Bandwidth Limit ► Enabled: To configure output bandwidth limit rule: 
• * Limit: Select Bandwidth Limit, to set the bandwidth limit size (MB/S); select Total Logs, to set the number of logs (items/sec);
• * Time Range: Select By day to set the daily bandwidth limit time period; select By week to set the weekly bandwidth limit time period.
► Disabled: No speed limit for log transfer, but subject to bandwidth.		 If disabled, the maximum number of output logs must not exceed 2000 each time, and the size must not exceed 300MB to ensure the stability of data transfer.
• Winlog Input Template: 
Field Name Field Description
* Aggregate Item Application, Security, or System can be selected.
* Filter Historical Files • Enabled: To configure Filter Range of time, filter historical log files according to the Filter Range;
• Disabled: The historical log files will be aggregated.
Note: Editing is allowed only when creating a new one, and not allowed after creation.
* Log Type windowsevent by default
Log Tag The custom tag fields for the log data

Note:
1. For the Windows log aggregation by AR-Agent, please confirm whether the AR-Agent installation package has been deployed and configured in the Windows system;
2. AR-Agent installation package is compatible with the follows: 
• Operating system: Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows Server 2016. Windows Server 2019, Windows XP, Windows 7, Windows 10;
• CPU Framework: x86, ARM