Use Cases
DataSight is a standalone console provided by CLS. You can access features such as log search, dashboards, and alarms without logging in to a Tencent Cloud root account. The following scenarios are suitable for integrating CLS into your system through DataSight:
CLS shared by multiple users and teams: Users frequently log in to the Tencent Cloud main console, which leads to high account management costs and deep feature access paths. They want team members to use it immediately without needing Tencent Cloud accounts.
Embedding into a unified Ops platform / business system: Embed log search and dashboards into the internal platform as native modules so that employees do not need to switch to external systems.
Reuse the internal account system of the enterprise: Integrate with LDAP, OAuth, or a self-developed login system to implement unified login.
One-click access to log context: Jump directly from business detail pages such as orders and tickets to the corresponding log search page or dashboard.
Unified domain and access entry: Use the corporate domain + reverse proxy to consolidate entry points, standardize HTTPS, and hide the real address for easier access control.
The integration capabilities of DataSight are listed in the following table:
|
Page embedding | iframe | Embed into a unified Ops platform or business system | |
Direct link access | URL parameter concatenation | Jump from a business system to a specified log search page/dashboard with one click | |
Unified domain name | Custom domain + reverse proxy | Hide the real domain name and unify HTTPS | |
Login integration | Reverse proxy + third-party authentication | Reuse the internal account system of the enterprise (LDAP/OAuth/self-developed) | |
Note:
DataSight can be integrated into internal enterprise systems, and it is also a complete standalone console. For usage details, see DataSight Standalone Console. Prerequisites
Before you start the integration, create and configure a DataSight instance first:
1. Create a DataSight instance: Follow the steps in DataSight Standalone Console to create an instance and select an access method. For integration scenarios (embedding or login integration), access over the private network is recommended. 2. Confirm the instance domain: View it in the CLS console under DataSight Instance Management. 3. Establish network connectivity: When private network access is used, the office network and the Tencent Cloud network must be interconnected (through Direct Connect / VPN / CCN).
Integration Capabilities
Embedding on a Page
DataSight pages are standard Web pages and can be embedded into internal systems through iframes. Combined with URL parameters, you can:
Directly access the search page of a specified log topic or a specified dashboard.
Hide page elements such as navigation, menus, and buttons by using the hide* parameters to keep embedded pages clean.
The following is an embedding example:
function prepareSdkFrame(url) {
var ifrm = document.createElement("iframe");
ifrm.setAttribute("src", url);
ifrm.style.width = "1280px";
ifrm.style.height = "960px";
document.body.appendChild(ifrm);
}
const url = 'https://<domain-appid>.clsconsole.tencentcls.com/cls/search?region=${Region}&topic_id=${TopicId}&query=${Query}&time=now-h,now&hideWidget=true&hideTopNav=true&hideLeftNav=true'
prepareSdkFrame(url)
Custom Domain and Reverse Proxy
A custom domain name and a reverse proxy are required in the following scenarios:
When embedding into internal systems, use the corporate domain name consistently to avoid exposing the actual DataSight domain name.
Unify HTTPS access entries.
Take over DataSight login redirects and integrate with the internal login system to achieve unified login.
Audit DataSight access records through the request logs of the reverse proxy module.
The following is an Nginx configuration example:
# Modify <your-domain.com>, <your-domain-cert>, and <domain-appid> (the DataSight domain prefix, which supports public/private domain names) in this configuration example based on your actual situation.
# It is highly recommended to enable HTTPS for your custom domain name and force HTTP to redirect to HTTPS to enhance browser request security and reduce queuing delays.
# The example uses the new domain name (tencentcls.com). For instances with the old domain name, replace it with tencent-cloud.com. The actual instance domain name prevails.
# To disable forced redirection to HTTPS, comment out this server configuration.
server {
listen 80;
server_name your-domain.com;
return 301 https://$host$request_uri;
}
server {
# To allow access via HTTP, uncomment the following line.
# listen 80;
listen 443 ssl http2;
server_name your-domain.com;
ssl_certificate your-domain-cert.pem;
ssl_certificate_key your-domain-cert.key;
location ~ ^/(.*) {
# You can add custom access control policies here, such as restricting access based on specific Referer values.
#set $match "$1::$http_referer";
#if ($match !~* ^(.+)::http[s]*://[www]*[.]*\\1.*$ ) {
# return 403;
#}
proxy_pass https://<domain-appid>.clsconsole.tencentcls.com;
proxy_set_header Host $proxy_host;
proxy_set_header Origin https://$proxy_host;
proxy_set_header Referer "https://$proxy_host/$1";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Proxy true;
proxy_set_header X-Proxy-Host $host;
proxy_set_header X-Proxy-Real-IP $remote_addr;
proxy_set_header X-Proxy-Forwarded-Proto $scheme;
proxy_redirect ~^(.*)/login\\?s_url=https?%3A%2F%2F[a-z0-9\\-]+(.internal)?.clsconsole.tencentcls.com%2F(.*)$ $1/login?s_url=https%3A%2F%2Fyour-domain.com%2F$3;
# To hide or customize the Tencent Cloud icon (favicon) on the DataSight page, use the following two headers.
# proxy_set_header X-DATASIGHT-HIDE-FAVICON true;
# proxy_set_header X-DATASIGHT-FAVICON-URL https://github.githubassets.com/favicons/favicon.png;
}
}
Integrating with an Internal Login System
Integration Principles
Reverse proxy software such as Nginx can be deployed as a front-end login verification module to integrate with internal login systems.
Only after the user completes login will the reverse proxy forward the request to the protected backend service (DataSight).
After you select Third-party authentication login as the DataSight login method, DataSight does not perform login verification itself. Instead, it trusts the parameters passed by the reverse proxy to determine user identity. The login verification logic is fully controlled by your enterprise, so sensitive data such as internal login passwords is never passed to DataSight. Access control and auditing by user and by role are also supported.
In requests sent from the reverse proxy to DataSight, specify the username through the X-DATASIGHT-USER header and the role name through the X-DATASIGHT-ROLE header. To pass multiple role names at once, you can also use the X-DATASIGHT-ROLES header in the following formats. DataSight will use the first one as the role name.
A string separated by English commas: role1,role2.
A JSON array string: ["role1", "role2"].
Prerequisites
Create a DataSight role (role name + the SecretId/SecretKey of the corresponding CAM sub-user).
Configure the reverse proxy.
Register the private IP address or CIDR of the reverse proxy in the DataSight configuration. Multiple entries are supported, separated by English commas.
Connectivity Verification
After the configuration is complete, run the following command in the environment where the reverse proxy resides or in a similar network environment:
curl -X POST \\
-H "X-DATASIGHT-USER:your_user" \\
-H "X-DATASIGHT-ROLE:your_role" \\
https://<domain-appid>.clsconsole.tencentcls.com/api/user
Return {"isLoggedIn":true,...,"username":"your_user","role":"your_role","isAuthProxy":true}: This indicates that the DataSight login authentication proxy is accessible and has automatically completed login by using the login information in the header.
Return {"isLoggedIn":false,"domain":""}: This indicates that the DataSight login authentication proxy is accessible, but the role corresponding to X-DATASIGHT-ROLE is not configured in DataSight. Check step 2 of the prerequisites.
It returns intranet access denied: xxxx, which indicates that the current VPC/IP address is not in the allowed range. Check the IP address registration in the prerequisites.
Security Considerations
DataSight trusts the header, which means the header can be forged. Therefore, you must ensure that:
Private network isolation: DataSight can be accessed only over the private network (unreachable from the internet), and users cannot bypass the reverse proxy to directly connect to DataSight.
IP address registration: DataSight only trusts registered reverse proxy sources.
Preventing identity spoofing: The reverse proxy must remove or overwrite the X-DATASIGHT-USER / X-DATASIGHT-ROLE / X-DATASIGHT-ROLES headers provided by clients in inbound requests. Otherwise, users can forge these headers to impersonate others when accessing through the reverse proxy.
Configuration Example
Integration Examples
Case 1: iframe Embedding + Login-Free Access (Simplest, Direct Private Network Embedding)
Applicable scenario: In a trusted private network environment, all users can view logs directly without accounts.
Configuration method:
1.1 Enable anonymous login for DataSight (supported only for private network access), and use read-only sub-user keys.
1.2 For embedding in an iframe on internal platform pages, see Page embedding for details. Security note: The access boundary for anonymous login = the private network boundary. Use it with caution when logs contain sensitive information.
Case 2: Integrating with LDAP/OAuth/OIDC Authentication
Applicable scenario: The enterprise uses an LDAP/AD/OAuth/OIDC account system internally.
Case 3: Integrating with a Self-Developed Login System (Non-Standard Protocol)
Applicable scenario: The internal login protocol is a self-developed cookie/token system rather than standard LDAP/OAuth, so it cannot be directly integrated.
Configuration method: Enable third-party authentication login for DataSight, and then see Integrating with an Internal Login System to complete the configuration. DataSight does not inherently restrict login protocols. As long as the reverse proxy can specify the username through the X-DATASIGHT-USER header and the role name through the X-DATASIGHT-ROLE header, it is supported. Case 4: Deep Linking to Business Systems
Applicable scenario: Jump from a business system (such as an order or ticket detail page) to the corresponding log search results or dashboard with one click.
Configuration method:
1.1 Construct the DataSight URL. If a reverse proxy is enabled, enter the reverse proxy domain name.
FAQs
Why Do the Top/Left Navigation Bars Remain After Embedding, Making the Page Look Non-Native?
Is Anonymous Login Secure?
The access boundary for anonymous login = the private network boundary. Use it with caution when logs contain sensitive information. We recommend integrating with an internal login system to enable login-free access.
How to Control Permissions by User / Role?
What to Do When iframe Integration Cannot Meet Requirements and Deeper Integration Is Needed?