Simple Log Service:Query and analyze logs

Step 1: Enter a query statement

1. Log on to the Simple Log Service console.

2. In the Projects section, click the project that you want to manage.

   

3. In the left-side navigation pane, click Log Storage. In the Logstores list, click the Logstore that you want to manage.

   

4. Enter a search statement or an analysis statement.

   • A search statement is used to query and filter data. A search statement supports only simple query. You can specify conditions in a search statement to filter data. The conditions include time ranges, request types, and keywords. You can separately use a search statement. For more information, see Search syntax.

   • An analytic statement is used to filter, convert, calculate, and aggregate data. For example, you can use an analytic statement to calculate an average value within a specific period of time or compare data in different periods of time. You must use an analytic statement together with a search statement in the Search statement|Analytic statement format. For more information, see Function overview.

5. Specify the time range of data that you want to query or analyze. You can use one of the following methods to specify a time range. If you specify a time range in an analytic statement, the time range is used for query and analysis.

   Important

   By default, only 100 rows of data are returned after you execute a query statement. To increase the number of rows of data that are returned, you can use a LIMIT clause. For more information, see LIMIT clause.

   • In the upper part of the query and analysis page, select a time range from the drop-down list. Example: Last 15 Minutes.

   • In the analytic statement, use the __time__ field to specify a time range, which is a closed time interval. Example: * | SELECT * FROM log WHERE __time__>1558013658 AND __time__< 1558013660.

   • In the analytic statement, use the from_unixtime or to_unixtime function to convert the format of the specified time. Examples:

     • * | SELECT * FROM log WHERE from_unixtime(__time__) > from_unixtime(1664186624) AND from_unixtime(__time__) < now()

     • * | SELECT * FROM log WHERE __time__ > to_unixtime(date_parse('2022-10-19 15:46:05', '%Y-%m-%d %H:%i:%s')) AND __time__ < to_unixtime(now())

Step 2: View query and analysis results

Histogram

• When you move the pointer over a green rectangle, you can view the period of time that is represented by the rectangle and the number of returned logs within the period of time.

• If you double-click a green rectangle, you can view log distribution at a finer-grained level. You can also view the returned logs within the specified period of time on the Raw Logs tab.

Raw Logs

The Raw Logs tab displays query and analysis results.

Supported operations

View charts

After you execute a query statement, you can view the query and analysis results on the Graph tab.

• View query and analysis results: Simple Log Service renders the results of the query statement to charts. Simple Log Service provides various types of charts, such as tables, line charts, and column charts. Simple Log Service provides two versions of charts: Pro and Standard. For more information, see Overview of charts (Pro) and Chart overview.

• Add a chart to a dashboard: Simple Log Service provides dashboards on which you can analyze data in real time. You can click Add to New Dashboard to save the query and analysis results as a chart to a dashboard. For more information, see Overview of visualization.

• Configure interaction occurrences: Interaction occurrences are important for data analysis. You can use interaction occurrences to switch between the levels of data dimensions and the analysis granularities to obtain more detailed information. For more information, see Interaction occurrences.

• Create a Scheduled SQL job: Simple Log Service provides the Scheduled SQL feature. You can use the feature to automatically analyze data at a scheduled time and aggregate data for storage. You can also use the feature to project and filter data. For more information, see How Scheduled SQL works.

LogReduce

On the LogReduce tab, you can click Enable LogReduce to cluster similar logs during log collection. For more information, see LogReduce.

SQL enhancement

If you use the Standard SQL feature to analyze a large amount of data that is generated over a period of time, Simple Log Service cannot analyze all data in a single query request. You can enable the Dedicated SQL feature to increase computing resources and the amount of data that can be analyzed in a single query request. For more information, see Enable Dedicated SQL.

Scan

If you need to query or analyze logs but you cannot or did not create indexes, you can use the scan feature. For more information, see Scan logs.

Alerting

You can click the icon to configure alerts for query and analysis results. For more information, see Configure an alert rule in Simple Log Service.

Saved search

You can click the icon to save a query statement as a saved search. For more information, see Saved search.

Sharing

You can click the icon to copy the link of the current page and share the link with other users.

References

• FAQ about query and analysis

• Time field conversion examples

• Query and analyze website logs

• Query and analyze JSON logs

• Collect and analyze NGINX access logs

• Analyze Layer 7 access logs of SLB