Back to Details

sap-btp-cloud-logging

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

SAP BTP Cloud Logging Skill

SAP BTP Cloud Logging 技能

Related Skills

相关技能

  • sap-btp-cloud-platform: Use for BTP subaccount setup, entitlements, and runtime context
  • sap-btp-cloud-identity-services: Use for SAML/IAS authentication and trust configuration
  • sap-btp-developer-guide: Use for application observability patterns across CAP and BTP apps
  • sap-btp-best-practices: Use for production monitoring and operations governance
  • sap-btp-cloud-platform：用于BTP子账户设置、权限分配和运行时上下文配置
  • sap-btp-cloud-identity-services：用于SAML/IAS认证和信任配置
  • sap-btp-developer-guide：用于CAP和BTP应用的应用可观测性模式
  • sap-btp-best-practices：用于生产环境监控和运维治理

When to Use This Skill

适用场景

Use this skill when creating Cloud Logging instances, choosing service plans, configuring Cloud Foundry/Kyma/OpenTelemetry/JSON ingestion, rotating certificates, setting up OpenSearch dashboards, enabling SAML, or troubleshooting missing logs, metrics, traces, or alerts.
当你需要创建Cloud Logging实例、选择服务套餐、配置Cloud Foundry/Kyma/OpenTelemetry/JSON采集方式、轮换证书、设置OpenSearch Dashboards、启用SAML认证，或排查日志、指标、链路追踪或告警缺失等问题时，使用本技能。

Table of Contents

目录

Service Overview

服务概述

SAP Cloud Logging is an instance-based observability service built on OpenSearch that stores, visualizes, and analyzes application logs, metrics, and traces from SAP BTP Cloud Foundry, Kyma, Kubernetes, and other runtime environments.
Key Capabilities:
  • Ingest logs, metrics, and traces via OpenTelemetry (OTLP) or JSON API
  • Ingest application and request logs from Cloud Foundry runtime
  • Configure data retention (1-90 days)
  • Visualize and analyze data in OpenSearch Dashboards
  • Create custom dashboards and alerts
  • SAML authentication via SAP Identity Authentication Service
SAP Cloud Logging是基于OpenSearch构建的实例化可观测性服务，用于存储、可视化和分析来自SAP BTP Cloud Foundry、Kyma、Kubernetes及其他运行时环境的应用日志、指标和链路追踪数据。
核心能力：
  • 通过OpenTelemetry (OTLP)或JSON API采集日志、指标和链路追踪数据
  • 采集Cloud Foundry运行时的应用日志和请求日志
  • 配置数据保留周期（1-90天）
  • 在OpenSearch Dashboards中可视化和分析数据
  • 创建自定义仪表盘和告警
  • 通过SAP Identity Authentication Service实现SAML认证

Service Plans

服务套餐

PlanCapacityUse CaseAuto-Scaling
dev7.5 GB fixedEvaluation onlyNo
standard75 GB - 375 GBProduction (100 logs/sec)Yes
large750 GB - 3.75 TBProduction (1000 logs/sec)Yes
Important: Plan updates are not supported. Migration requires running instances in parallel.
套餐容量适用场景Auto-Scaling
dev固定7.5 GB仅用于评估否
standard75 GB - 375 GB生产环境（100条日志/秒）是
large750 GB - 3.75 TB生产环境（1000条日志/秒）是
重要提示： 不支持套餐升级。如需迁移，需并行运行新旧实例。

Quick Start

快速开始

Prerequisites

前置条件

  1. SAP BTP Global Account
  2. Subaccount with Cloud Logging entitlement
  3. (Recommended) SAP Cloud Identity Services tenant for SAML authentication
Note for SAP Build Code Users: If using SAP Build Code, follow the SAP Build Code Initial Setup instructions instead. Cloud Logging in SAP Build Code is available for evaluation purposes only.
  1. SAP BTP全球账户
  2. 拥有Cloud Logging权限的子账户
  3. （推荐）用于SAML认证的SAP Cloud Identity Services租户
SAP Build Code用户注意事项： 若使用SAP Build Code，请遵循SAP Build Code初始设置说明。SAP Build Code中的Cloud Logging仅用于评估目的。

Instance Creation Options

实例创建选项

Choose one method based on your workflow:
Option 1: SAP BTP Cockpit (UI)
  1. Navigate to Subaccount → Instances and Subscriptions → Create
  2. Select 
    cloud-logging
    service and plan
  3. Configure parameters (see Configuration section)
  4. Create service key for credentials
Option 2: Cloud Foundry CLI
bash
cf create-service cloud-logging standard my-cls-instance -c '{
  "retention_period": 14,
  "backend": { "max_data_nodes": 10 },
  "ingest": { "max_instances": 10 }
}'
根据你的工作流选择以下一种方式：
选项1：SAP BTP Cockpit（UI界面）
  1. 导航至子账户 → 实例与订阅 → 创建
  2. 选择
    cloud-logging
    服务及对应套餐
  3. 配置参数（详见配置章节）
  4. 创建服务密钥以获取凭证
选项2：Cloud Foundry CLI
bash
cf create-service cloud-logging standard my-cls-instance -c '{
  "retention_period": 14,
  "backend": { "max_data_nodes": 10 },
  "ingest": { "max_instances": 10 }
}'

Wait for provisioning

等待实例创建完成

cf services # Check "last operation" status
cf services # 查看"last operation"状态

Create service key

创建服务密钥

cf create-service-key my-cls-instance my-cls-key cf service-key my-cls-instance my-cls-key

**Option 3: SAP BTP CLI**
```bash
btp create services/instance \
  --subaccount <SUBACCOUNT_ID> \
  --name my-cls-instance \
  --offering-name "cloud-logging" \
  --plan-name standard \
  --parameters '{"retention_period": 14}'
cf create-service-key my-cls-instance my-cls-key cf service-key my-cls-instance my-cls-key

**选项3：SAP BTP CLI**
```bash
btp create services/instance \
  --subaccount <SUBACCOUNT_ID> \
  --name my-cls-instance \
  --offering-name "cloud-logging" \
  --plan-name standard \
  --parameters '{"retention_period": 14}'

Create binding

创建绑定

btp create services/binding
--subaccount <SUBACCOUNT_ID>
--name my-cls-binding
--instance-name my-cls-instance
btp create services/binding
--subaccount <SUBACCOUNT_ID>
--name my-cls-binding
--instance-name my-cls-instance

Get credentials

获取凭证

btp get services/binding --name my-cls-binding --subaccount <SUBACCOUNT_ID>

**Option 4: SAP BTP Service Operator (Kubernetes/Kyma)**
```yaml
apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: cloud-logging-instance
  namespace: sap-cloud-logging-integration
spec:
  serviceOfferingName: cloud-logging
  servicePlanName: standard
  parameters:
    retentionPeriod: 14
---
apiVersion: services.cloud.sap.com/v1
kind: ServiceBinding
metadata:
  name: cls-binding
  namespace: sap-cloud-logging-integration
spec:
  serviceInstanceName: cloud-logging-instance
  secretName: sap-cloud-logging
btp get services/binding --name my-cls-binding --subaccount <SUBACCOUNT_ID>

**选项4：SAP BTP Service Operator（Kubernetes/Kyma）**
```yaml
apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: cloud-logging-instance
  namespace: sap-cloud-logging-integration
spec:
  serviceOfferingName: cloud-logging
  servicePlanName: standard
  parameters:
    retentionPeriod: 14
---
apiVersion: services.cloud.sap.com/v1
kind: ServiceBinding
metadata:
  name: cls-binding
  namespace: sap-cloud-logging-integration
spec:
  serviceInstanceName: cloud-logging-instance
  secretName: sap-cloud-logging

Configuration Parameters

配置参数

ParameterTypeDefaultDescription
retention_period
int7Data retention in days (1-90)
backend.max_data_nodes
int10Max OpenSearch data nodes (2-10)
dashboards.custom_label
string-Dashboard identifier (max 20 chars)
ingest.max_instances
int10Max ingest instances for autoscaling (2-10)
ingest.min_instances
int2Min ingest instances (2-10)
ingest_otlp.enabled
boolfalseEnable OpenTelemetry Protocol ingestion
feature_flags
array[]Experimental features (e.g., 
upgradeToOpenSearchV2
)
rotate_root_ca
boolfalseTrigger CA certificate rotation
saml
object-SAML authentication configuration
参数类型默认值描述
retention_period
int7数据保留天数（1-90）
backend.max_data_nodes
int10OpenSearch数据节点最大数量（2-10）
dashboards.custom_label
string-仪表盘标识符（最多20个字符）
ingest.max_instances
int10采集实例自动扩容上限（2-10）
ingest.min_instances
int2采集实例最小数量（2-10）
ingest_otlp.enabled
boolfalse启用OpenTelemetry Protocol采集
feature_flags
array[]实验性功能（例如
upgradeToOpenSearchV2
）
rotate_root_ca
boolfalse触发CA证书轮换
saml
object-SAML认证配置

Full Configuration Example

完整配置示例

json
{
  "retention_period": 14,
  "feature_flags": ["upgradeToOpenSearchV2"],
  "dashboards": {
    "custom_label": "PROD-CLS"
  },
  "backend": {
    "max_data_nodes": 10
  },
  "ingest": {
    "max_instances": 10,
    "min_instances": 2
  },
  "ingest_otlp": {
    "enabled": true
  },
  "saml": {
    "enabled": true,
    "initiated": true,
    "admin_group": "CLS-Admins",
    "roles_key": "groups",
    "idp": {
      "metadata_url": "https://<tenant>.accounts.ondemand.com/saml2/metadata",
      "entity_id": "https://<tenant>.accounts.ondemand.com"
    },
    "sp": {
      "entity_id": "cloud-logging-<instance-id>"
    }
  }
}
json
{
  "retention_period": 14,
  "feature_flags": ["upgradeToOpenSearchV2"],
  "dashboards": {
    "custom_label": "PROD-CLS"
  },
  "backend": {
    "max_data_nodes": 10
  },
  "ingest": {
    "max_instances": 10,
    "min_instances": 2
  },
  "ingest_otlp": {
    "enabled": true
  },
  "saml": {
    "enabled": true,
    "initiated": true,
    "admin_group": "CLS-Admins",
    "roles_key": "groups",
    "idp": {
      "metadata_url": "https://<tenant>.accounts.ondemand.com/saml2/metadata",
      "entity_id": "https://<tenant>.accounts.ondemand.com"
    },
    "sp": {
      "entity_id": "cloud-logging-<instance-id>"
    }
  }
}

Data Ingestion Methods

数据采集方式

1. Cloud Foundry Runtime

1. Cloud Foundry运行时

Bind applications directly to the Cloud Logging instance:
bash
cf bind-service <app-name> <cls-instance>
Index Patterns:
  • logs-cfsyslog-*
    - Application logs
  • metrics-otel-v1-*
    - Resource metrics
For user-provided services with mTLS, see 
references/cf-ingestion.md
.
将应用直接绑定到Cloud Logging实例：
bash
cf bind-service <app-name> <cls-instance>
索引模式：
  • logs-cfsyslog-*
    - 应用日志
  • metrics-otel-v1-*
    - 资源指标
如需了解使用mTLS的用户提供服务，请查看
references/cf-ingestion.md
。

2. Kyma Runtime

2. Kyma运行时

Requires 
telemetry
and 
btp-operator
modules enabled:
bash
undefined
需要启用
telemetry
和
btp-operator
模块：
bash
undefined

Create namespace

创建命名空间

kubectl create namespace sap-cloud-logging-integration
kubectl create namespace sap-cloud-logging-integration

Deploy ServiceInstance and ServiceBinding (see templates above)

部署ServiceInstance和ServiceBinding（详见上方模板）

kubectl apply -n sap-cloud-logging-integration -f cls-instance.yaml

**Index Patterns:**
- `logs-json-istio-envoy-kyma*` - Istio access logs
- `logs-json-kyma*` - Application logs
kubectl apply -n sap-cloud-logging-integration -f cls-instance.yaml

**索引模式：**
- `logs-json-istio-envoy-kyma*` - Istio访问日志
- `logs-json-kyma*` - 应用日志

3. OpenTelemetry API (OTLP)

3. OpenTelemetry API (OTLP)

Enable with 
ingest_otlp.enabled: true
, then configure your application:
Service Key Credentials:
  • ingest-otlp-endpoint
    - gRPC endpoint (hostname:443)
  • ingest-otlp-cert
    - Client certificate (PEM)
  • ingest-otlp-key
    - Private key (PKCS#8)
  • server-ca
    - Server CA certificate
Index Patterns:
  • logs-otel-v1-*
    - Logs
  • metrics-otel-v1-*
    - Metrics
  • otel-v1-apm-span-*
    - Traces
  • otel-v1-apm-service-map
    - Service map
Note: Only gRPC protocol supported. Use OpenTelemetry Collector to convert http/protobuf or http/json.
For Java/Node.js automation libraries, see 
references/opentelemetry-ingestion.md
.
通过设置
ingest_otlp.enabled: true
启用，然后配置你的应用：
服务密钥凭证：
  • ingest-otlp-endpoint
    - gRPC端点（hostname:443）
  • ingest-otlp-cert
    - 客户端证书（PEM格式）
  • ingest-otlp-key
    - 私钥（PKCS#8格式）
  • server-ca
    - 服务器CA证书
索引模式：
  • logs-otel-v1-*
    - 日志
  • metrics-otel-v1-*
    - 指标
  • otel-v1-apm-span-*
    - 链路追踪
  • otel-v1-apm-service-map
    - 服务地图
注意： 仅支持gRPC协议。使用OpenTelemetry Collector转换http/protobuf或http/json格式。
如需Java/Node.js自动化库，请查看
references/opentelemetry-ingestion.md
。

4. JSON API

4. JSON API

Send logs via HTTP with mTLS:
bash
curl -X PUT "https://<ingest-endpoint>/v1/ingest" \
  --cert client.crt --key client.key \
  -H "Content-Type: application/json" \
  -d '[{"msg": "log message", "date": "2025-01-15T10:30:00Z"}]'
Index Pattern: 
logs-json-*
For Fluent Bit configuration, see 
references/json-api-ingestion.md
.
通过HTTP和mTLS发送日志：
bash
curl -X PUT "https://<ingest-endpoint>/v1/ingest" \
  --cert client.crt --key client.key \
  -H "Content-Type: application/json" \
  -d '[{"msg": "log message", "date": "2025-01-15T10:30:00Z"}]'
索引模式： 
logs-json-*
如需Fluent Bit配置，请查看
references/json-api-ingestion.md
。

Certificate Management

证书管理

Certificate Validity

证书有效期

  • Default: 90 days
  • Configurable: 1-180 days via 
    certValidityDays
    in binding parameters
  • 默认：90天
  • 可配置：通过绑定参数
    certValidityDays
    设置1-180天

Root CA Rotation (3-Step Process)

根CA轮换（三步流程）

CAUTION: Not following this process causes ingestion interruption.
  1. Create new CA: Update instance with 
    "rotate_root_ca": true
  2. Rebind all applications: Create new bindings for each shipping mechanism
  3. Delete old CA: Update instance with 
    "rotate_root_ca": false
注意： 不遵循此流程会导致采集中断。
  1. 创建新CA： 更新实例并设置
    "rotate_root_ca": true
  2. 重新绑定所有应用： 为每个采集机制创建新绑定
  3. 删除旧CA： 更新实例并设置
    "rotate_root_ca": false

OpenSearch Dashboards

OpenSearch Dashboards

Access

访问

  1. Create service binding/key
  2. Navigate to 
    dashboards-url
    from credentials
  3. Authenticate (SAML or basic auth)
  1. 创建服务绑定/密钥
  2. 从凭证中导航至
    dashboards-url
  3. 进行认证（SAML或基础认证）

Pre-built Dashboards

预构建仪表盘

  • Cloud Foundry application performance
  • Request latency and error rates
  • Resource utilization metrics
  • Cloud Foundry应用性能
  • 请求延迟和错误率
  • 资源利用率指标

Custom Dashboards & Alerting

自定义仪表盘与告警

  • Create custom dashboards for specific analysis needs
  • Configure alerting based on observability data
  • Integrate with SAP Alert Notification for SAP BTP for advanced alerting workflows
  • 创建自定义仪表盘以满足特定分析需求
  • 基于可观测性数据配置告警
  • 与SAP Alert Notification for SAP BTP集成以实现高级告警工作流

Index Patterns Summary

索引模式汇总

SourceIndex Pattern
CF Logs
logs-cfsyslog-*
CF Metrics
metrics-otel-v1-*
OTLP Logs
logs-otel-v1-*
OTLP Metrics
metrics-otel-v1-*
OTLP Traces
otel-v1-apm-span-*
JSON API
logs-json-*
Kyma Apps
logs-json-kyma*
Kyma Istio
logs-json-istio-envoy-kyma*
Note: Attribute names use 
@
instead of 
.
due to OpenSearch/Lucene limitations.
来源索引模式
CF日志
logs-cfsyslog-*
CF指标
metrics-otel-v1-*
OTLP日志
logs-otel-v1-*
OTLP指标
metrics-otel-v1-*
OTLP链路追踪
otel-v1-apm-span-*
JSON API
logs-json-*
Kyma应用
logs-json-kyma*
Kyma Istio
logs-json-istio-envoy-kyma*
注意： 由于OpenSearch/Lucene限制，属性名称使用
@
而非
.
。

Security Best Practices

安全最佳实践

Security Recommendations

安全建议

  • BTP-CLS-0001: Configure SAML authentication with Identity Authentication Service (critical)
  • BTP-CLS-0002: Rotate service keys regularly; deletion doesn't automatically invalidate credentials
  • BTP-CLS-0003: Review Kyma runtime and JSON API security configuration
Note: Only BTP-CLS-0001 (critical level) is currently reported to SAP Cloud ALM. Other recommendations must be manually verified.
  • BTP-CLS-0001： 配置基于Identity Authentication Service的SAML认证（关键）
  • BTP-CLS-0002： 定期轮换服务密钥；删除密钥不会自动使凭证失效
  • BTP-CLS-0003： 审核Kyma运行时和JSON API的安全配置
注意： 目前仅BTP-CLS-0001（关键级别）会上报至SAP Cloud ALM。其他建议需手动验证。

SAML Authentication Setup

SAML认证设置

  1. Create SAML 2.0 application in SAP Identity Authentication
  2. Configure "groups" attribute from Identity Directory
  3. Set Name ID Format to "E-mail"
  4. Enable request signing (recommended)
  5. Configure 
    saml
    parameters in instance configuration
  6. The 
    admin_group
    maps to 
    all_access
    role
See 
references/saml-authentication.md
for detailed setup.
  1. 在SAP Identity Authentication中创建SAML 2.0应用
  2. 配置来自Identity Directory的"groups"属性
  3. 将Name ID格式设置为"E-mail"
  4. 启用请求签名（推荐）
  5. 在实例配置中设置
    saml
    参数
  6. admin_group
    映射到
    all_access
    角色
详细设置请查看
references/saml-authentication.md
。

Backup & Recovery

备份与恢复

Automatic Backups

自动备份

Backed up: OpenSearch settings, roles, role mappings, tenants, groups, security configs, saved objects, ISM policies Not backed up: Alerts
备份内容： OpenSearch设置、角色、角色映射、租户、组、安全配置、保存的对象、ISM策略 不备份内容： 告警

Restoration Process

恢复流程

Create SAP support ticket with component 
BC-CP-CLS
including:
  1. Dashboard URL
  2. Instance configuration
  3. Deprovisioning timestamp
  4. Target restoration date (max 7 days)
  5. Owner information
  6. Business justification
创建组件为
BC-CP-CLS
的SAP支持工单，包含以下信息：
  1. 仪表盘URL
  2. 实例配置
  3. 注销时间戳
  4. 目标恢复日期（最长7天）
  5. 所有者信息
  6. 业务理由

Common Issues & Troubleshooting

常见问题与排查

Instance Creation Fails

实例创建失败

  • Verify entitlement in subaccount
  • Check service plan availability in region
  • Validate JSON configuration syntax
  • 验证子账户中的权限
  • 检查服务套餐在对应区域的可用性
  • 验证JSON配置语法

Ingestion Not Working

采集功能异常

  • Verify binding credentials are current (check certificate expiry)
  • For CF: Binding takes effect without restaging
  • For OTLP: Ensure 
    ingest_otlp.enabled: true
  • Check network connectivity to ingest endpoint
  • 验证绑定凭证是否有效（检查证书过期时间）
  • 对于CF：绑定无需重启应用即可生效
  • 对于OTLP：确保
    ingest_otlp.enabled: true
  • 检查与采集端点的网络连通性

Dashboard Access Issues

仪表盘访问问题

  • Verify SAML configuration if enabled
  • Check user is in configured admin group
  • Validate IdP metadata URL accessibility
  • 若启用SAML，验证SAML配置
  • 检查用户是否在配置的管理员组中
  • 验证IdP元数据URL是否可访问

Certificate Expiration

证书过期

  • Default validity: 90 days
  • Create new binding before expiration
  • Consider root CA rotation if widespread
  • 默认有效期：90天
  • 在过期前创建新绑定
  • 若涉及范围广，考虑根CA轮换

Reference Files

参考文件

For detailed information, see bundled reference files:
如需详细信息，请查看配套参考文件：

Configuration & Setup

配置与设置

  • references/service-plans.md
    (183 lines) - Service plans comparison and capacity planning
  • references/configuration-parameters.md
    (270 lines) - Complete parameter reference with examples
  • references/service-plans.md
    （183行）- 服务套餐对比与容量规划
  • references/configuration-parameters.md
    （270行）- 完整参数参考及示例

Ingestion Methods

采集方式

  • references/cf-ingestion.md
    (211 lines) - Cloud Foundry ingestion details
  • references/kyma-ingestion.md
    (293 lines) - Kyma runtime integration
  • references/opentelemetry-ingestion.md
    (363 lines) - OTLP setup with Java/Node.js automation
  • references/json-api-ingestion.md
    (435 lines) - JSON API and Fluent Bit configuration
  • references/cf-ingestion.md
    （211行）- Cloud Foundry采集详情
  • references/kyma-ingestion.md
    （293行）- Kyma运行时集成
  • references/opentelemetry-ingestion.md
    （363行）- OTLP与Java/Node.js自动化设置
  • references/json-api-ingestion.md
    （435行）- JSON API与Fluent Bit配置

Security & Authentication

安全与认证

  • references/saml-authentication.md
    (329 lines) - SAML setup with Identity Authentication Service
  • references/saml-authentication.md
    （329行）- 基于Identity Authentication Service的SAML设置

Documentation Links

文档链接

Official Sources

官方来源

Bundled Resources

配套资源

Reference Documentation

参考文档

  • references/cf-ingestion.md
    - Cloud Foundry runtime ingestion guide
  • references/kyma-ingestion.md
    - Kyma/Cloud Foundry Kyma runtime ingestion
  • references/opentelemetry-ingestion.md
    - OpenTelemetry data ingestion
  • references/json-api-ingestion.md
    - JSON API ingestion methods
  • references/saml-authentication.md
    - SAML authentication configuration
  • references/service-plans.md
    - Service plans comparison and selection
  • references/cf-ingestion.md
    - Cloud Foundry运行时采集指南
  • references/kyma-ingestion.md
    - Kyma/Cloud Foundry Kyma运行时采集
  • references/opentelemetry-ingestion.md
    - OpenTelemetry数据采集
  • references/json-api-ingestion.md
    - JSON API采集方式
  • references/saml-authentication.md
    - SAML认证配置
  • references/service-plans.md
    - 服务套餐对比与选择

Related Documentation

相关文档

Data Protection Notice

数据保护说明

SAP Cloud Logging is not designed for personal or business-critical data. Take measures to prevent transmission of such data. Data is stored regionally but physical data center locations may differ from consumption locations within the same region.
SAP Cloud Logging不适合存储个人数据或业务关键数据。请采取措施防止此类数据传输。数据按区域存储，但同一区域内的物理数据中心位置可能与消费位置不同。