All Products
Search

This Product

    Simple Log Service:Log field details

    Document Center

    Simple Log Service:Log field details

    Last Updated:Dec 25, 2025

    This topic describes the log fields for Object Storage Service (OSS).

    OSS log types

    Log type

    Description

    Access logs

    • This feature must be enabled manually. For more information, see Enable the log collection feature.

    • Collects all access logs and deletion information from batch deletion logs for the specified OSS bucket in real time.

      Note

      • When you call the DeleteObjects operation, a request record is generated in the access log.

      • oss-log-store may contain both Access Logs and Hourly Metering Logs (which are different from the metering logs described below). _topic_:oss_access_log represents Access Logs, and _topic_:oss_metering_log represents Hourly Metering Logs.

    Metering logs

    • Enabled by default for free.

    • Records the hourly accumulated metering data for a specific OSS bucket. The log collection time is several hours later than the actual generation time. These logs are used for auxiliary analysis.

    Monitoring metrics

    • Enabled by default for free.

    • Records metrics such as requests, latency, and traffic at a 10-second granularity, and metrics such as requests and traffic at a 5-minute granularity.

    Access logs

    Field

    Description

    __topic__

    The log topic. The value is fixed to oss_access_log.

    time

    The time when the OSS request ended, for example, 27/Feb/2018:13:58:45.

    If you need a timestamp, use the __time__ field.

    access_id

    The AccessKey ID of the requester.

    owner_id

    The Alibaba Cloud account ID of the OSS bucket owner.

    user_agent

    The User-Agent header of the HTTP request, for example, curl/7.15.5.

    logging_flag

    Indicates whether the feature that periodically exports logs to an OSS bucket is enabled. A value of true indicates that the feature is enabled.

    bucket

    The name of the OSS bucket.

    content_length_in

    The value of Content-Length in the request header. Unit: bytes.

    content_length_out

    The value of Content-Length in the response header. Unit: bytes.

    object

    The requested OSS object. The object is URL encoded.

    When you query the object, run select url_decode(object) to decode it.

    object_size

    The size of the OSS object. Unit: bytes.

    operation

    The API operation. For more information, see Appendix: API operations.

    bucket_location

    The data center where the OSS bucket is located. The format is usually oss-<region ID>.

    request_uri

    The URI of the HTTP request, including the query string. The URI is URL encoded.

    When you query the URI, run select url_decode(request_uri) to decode it.

    error_code

    The error code returned by OSS. For more information, see OSS error codes.

    request_length

    The size of the HTTP request, including the header. Unit: bytes.

    client_ip

    The IP address from which the request is initiated. This can be the IP address of the client, its network firewall, or a proxy.

    response_body_length

    The size of the body in the HTTP response, excluding the header.

    http_method

    The HTTP request method.

    referer

    The HTTP Referer of the request.

    requester_id

    The ID of the requester. If the access is anonymous, a hyphen (-) is displayed.

    request_id

    The request ID.

    response_time

    The HTTP response time. Unit: milliseconds.

    server_cost_time

    The time that the OSS server takes to process the request. Unit: milliseconds.

    http_type

    The HTTP request type. Valid values: HTTP and HTTPS.

    sign_type

    The signature type.

    • NotSign: The request is not signed.

    • NormalSign: The request is signed in a common way.

    • UriSign: The request is signed using a URL.

    • AdminSign: Specifies the administrator account.

    • NORMAL_SIGN4: V4 signature.

    • URI_SIGN4: V4 signature included in a URL.

    http_status

    The status returned for the HTTP request.

    sync_request

    The synchronization request type.

    • Hyphen (-): a common request.

    • cdn: a back-to-origin request from CDN.

    • lifecycle: a request to set a lifecycle rule.

    bucket_storage_type

    The storage class of the OSS object.

    • standard: Standard

    • archive: Archive

    • IA: Infrequent Access

    host

    The endpoint used for the request, for example, bucket123.oss-cn-beijing.aliyuncs.com.

    vpc_addr

    The Havip address of the VPC where OSS is located.

    This address is an integer, for example, 343819108. Use int_to_ip(cast(vpc_addr as bigint)) to convert it to an IP address. After the conversion, you must reverse the IP address. For example, if the conversion result is 9.58.XXX.XXX, the reversed result is XXX.XXX.58.9.

    vpc_id

    The ID of the VPC where OSS is located.

    delta_data_size

    The change in the size of the OSS object. If the size does not change, the value is 0. If the request is not an upload request, a hyphen (-) is returned.

    ec

    The detailed error code. To troubleshoot issues based on the error code, see Troubleshoot issues based on ECs.

    acc_access_region

    If the request is a transfer acceleration request, this field indicates the region of the access point. Otherwise, a hyphen (-) is returned.

    restore_priority

    The restoration priority.

    extend_information

    An extended field. The default value is a hyphen (-).

    If a request is initiated using a RAM role, the log records the information about the RAM role. The information is concatenated in the requesterParentId,roleName,roleSessionName,roleOwnerId format. The fields are separated by commas (,). New fields may be added.

    user_defined_log_fields

    An extended field. The default value is a hyphen (-).

    If you configure custom headers and parameters for the bucket, the log records the information about the matching headers and parameters. The value is the Base64 encoding of a JSON field.

    archive_direct_read_size

    The billed size for real-time access of Archive objects generated by the request. If real-time access of Archive objects is not used, a hyphen (-) is returned. Unit: bytes.

    Metering logs

    Field

    Description

    __topic__

    The log topic. The value is fixed to oss_metering_log.

    owner_id

    The Alibaba Cloud account ID of the OSS bucket owner.

    bucket

    The name of the OSS bucket.

    cdn_in

    The inbound traffic from CDN. Unit: bytes.

    cdn_out

    The outbound traffic to CDN. Unit: bytes.

    metering_datasize

    The size of the metered data for non-Standard storage classes.

    get_request

    The number of GET requests.

    intranet_in

    The inbound traffic over the internal network. Unit: bytes.

    intranet_out

    The outbound traffic over the internal network. Unit: bytes.

    network_in

    The inbound traffic over the Internet. Unit: bytes.

    network_out

    The outbound traffic over the Internet. Unit: bytes.

    put_request

    The number of PUT requests.

    storage

    The storage usage of the OSS bucket. Unit: bytes.

    storage_type

    The storage class of the OSS bucket.

    • standard: Standard

    • archive: Archive Storage

    • IA: Infrequent Access

    process_img_size

    The size of the processed image. Unit: bytes.

    sync_in

    The inbound traffic for synchronization. Unit: bytes.

    sync_out

    The outbound traffic for synchronization. Unit: bytes.

    start_time

    The start timestamp of the metering. Unit: seconds.

    end_time

    The end timestamp of the metering. Unit: seconds.

    region

    The region where the OSS bucket is located.

    process_img

    The processed image.

    bucket_location

    The data center where the OSS bucket is located. The format is usually oss-<region ID>.

    standard_total

    Standard - Total physical capacity. Unit: bytes.

    standard_lrs

    Standard - Locally redundant storage - Physical capacity. Unit: bytes.

    standard_zrs

    Standard - Zone-redundant storage - Physical capacity. Unit: bytes.

    ia_total

    IA storage class - Total physical capacity. Unit: bytes.

    ia_lrs

    IA storage class - Locally redundant storage - Physical capacity. Unit: bytes.

    ia_zrs

    IA storage class - Zone-redundant storage - Physical capacity. Unit: bytes.

    ia_total_charged_datasize

    IA storage class - Total billable storage usage. Unit: bytes.

    ia_lrs_charged_datasize

    IA storage class - Locally redundant storage - Billable storage usage. Unit: bytes.

    ia_zrs_charged_datasize

    IA storage class - Zone-redundant storage - Billable storage usage. Unit: bytes.

    archive_total

    Archive Storage - Total physical capacity. Unit: bytes.

    archive_lrs

    Archive Storage - Locally redundant storage - Physical capacity. Unit: bytes.

    archive_zrs

    Archive Storage - Zone-redundant storage - Physical capacity. Unit: bytes.

    archive_total_charged_datasize

    Archive Storage - Total billable storage usage. Unit: bytes.

    archive_lrs_charged_datasize

    Archive Storage - Locally redundant storage - Billable storage usage. Unit: bytes.

    archive_zrs_charged_datasize

    Archive Storage - Zone-redundant storage - Billable storage usage. Unit: bytes.

    coldarchive_total

    Cold Archive - Total physical capacity. Unit: bytes.

    coldarchive_lrs

    Cold Archive - Locally redundant storage - Initial physical capacity. Unit: bytes.

    coldarchive_total_charged_datasize

    Cold Archive - Total billable storage usage. Unit: bytes.

    coldarchive_lrs_charged_datasize

    Cold Archive - Locally redundant storage - Billable storage usage. Unit: bytes.

    deepcoldarchive_total

    Deep Cold Archive - Total physical capacity. Unit: bytes.

    deepcoldarchive_lrs

    Deep Cold Archive - Locally redundant storage - Physical capacity. Unit: bytes.

    deepcoldarchive_total_charged_datasize

    Deep Cold Archive - Total billable storage usage. Unit: bytes.

    deepcoldarchive_lrs_charged_datasize

    Deep Cold Archive - Locally redundant storage - Billable storage usage. Unit: bytes.

    reserved_capacity

    Reserved capacity - Total used capacity. Unit: bytes.

    reserved_capacity_lrs

    Reserved capacity - Locally redundant storage - Used capacity. Unit: bytes.

    reserved_capacity_zrs

    Reserved capacity - Zone-redundant storage - Used capacity. Unit: bytes.

    total_storage

    Total physical capacity. Unit: bytes.

    total_storage_charged_datasize

    Total billable storage usage (excluding Standard storage). Unit: bytes.

    Batch delete logs

    When you call the DeleteObjects operation, a request record is generated in the access log. However, because the information about the deleted files is stored in the HTTP request body, the value of the object field in the access log is a hyphen (-). To view the list of deleted files, you need to check the batch delete log. The following table describes the fields of a batch delete log. You can associate the batch delete log with the access log using the request_id field.

    Field name

    Description

    __topic__

    The log topic. The value is fixed to oss_batch_delete_log.

    bucket

    The name of the OSS bucket.

    bucket_location

    The data center where the OSS bucket is located. The format is oss-<region ID>.

    client_ip

    The IP address from which the request is initiated. This can be the IP address of the client, its network firewall, or a proxy.

    delta_data_size

    The change in the size of the OSS object. If the size does not change, the value is 0. If the request is not an upload request, a hyphen (-) is returned.

    error_code

    The error code returned by OSS. For more information, see OSS error codes.

    host

    The endpoint used for the request, for example, bucket123.oss-cn-beijing.aliyuncs.com.

    http_method

    The HTTP request method, for example, POST.

    http_status

    The status returned for the HTTP request.

    logging_flag

    Indicates whether the feature that periodically exports logs to an OSS bucket is enabled. A value of true indicates that the feature is enabled.

    object

    The requested OSS object. The object is URL encoded. When you query the object, run select url_decode(object) to decode it.

    object_size

    The size of the OSS object. This corresponds to the size of the requested object. Unit: bytes.

    operation

    The API operation. For more information, see Appendix: API operations.

    owner_id

    The Alibaba Cloud account ID of the OSS bucket owner.

    response_body_length

    The size of the HTTP response body, excluding the header.

    request_length

    The size of the HTTP request, including the header. Unit: bytes.

    referer

    The HTTP Referer of the request.

    request_id

    The request ID.

    requester_id

    The ID of the requester. If the access is anonymous, a hyphen (-) is returned.

    request_uri

    The URI of the request, including the query string. The URI is URL encoded. When you query the URI, run select url_decode(request_uri) to decode it.

    sync_request

    The synchronization request type.

    • Hyphen (-): a common request.

    • cdn: a back-to-origin request from CDN.

    • lifecycle: a request to set a lifecycle rule.

    server_cost_time

    The time that the OSS server takes to process the request. Unit: milliseconds.

    user_agent

    The User-Agent header of the HTTP request, for example, curl/7.15.5.

    Monitoring metrics

    The metrics described in this topic follow the metric data format. Use Prometheus Query Language (PromQL) or SQL to query and analyze the metrics. For more information, see Syntax of query and analysis on metric data.

    Metric

    Unit

    Description

    Labels

    private_net_in_traffic_10s

    byte

    Inbound traffic over the internal network per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    private_net_out_traffic_10s

    byte

    Outbound traffic over the internal network per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    public_net_in_traffic_10s

    byte

    Inbound traffic over the Internet per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    public_net_out_traffic_10s

    byte

    Outbound traffic over the Internet per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    cdn_in_10s

    byte

    Inbound traffic from CDN per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    cdn_out_10s

    byte

    Outbound traffic to CDN per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    sync_in_10s

    byte

    Inbound traffic for synchronization requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    sync_out_10s

    byte

    Outbound traffic for synchronization requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    request_cnt_total_10s

    Count

    Total number of requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    write_qps_10s

    Count

    Number of billable PUT, POST, and HEAD requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    read_qps_10s

    Count

    Number of billable GET requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    error_4xx_10s

    Count

    Number of 4xx requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    error_403_10s

    Count

    Number of 403 requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    error_404_10s

    Count

    Number of 404 requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    error_408_10s

    Count

    Number of 408 requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    error_499_10s

    Count

    Number of 499 requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    error_5xx_10s

    Count

    Number of 5xx requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    error_503_10s

    Count

    Number of 503 requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    success_2xx_10s

    Count

    Number of 2xx requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    success_203_10s

    Count

    Number of 203 requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    success_3xx_10s

    Count

    Number of 3xx requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    client_latency_10s

    millisecond

    Client-side latency per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    server_latency_10s

    millisecond

    Server-side latency per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    request_cnt_level4_10s

    Count

    Number of requests per 10 seconds for files larger than 1 MB.

    owner_id, region, bucket, storage_type, operation, sync_type

    client_latency_level4_10s

    millisecond

    Client-side latency per 10 seconds for files larger than 1 MB.

    owner_id, region, bucket, storage_type, operation, sync_type

    server_latency_level4_10s

    millisecond

    Server-side latency per 10 seconds for files larger than 1 MB.

    owner_id, region, bucket, storage_type, operation, sync_type

    request_cnt_level2_10s

    Count

    Number of requests per 10 seconds for files that are 100 KB to 200 KB in size.

    owner_id, region, bucket, storage_type, operation, sync_type

    client_latency_level2_10s

    millisecond

    Client-side latency per 10 seconds for files that are 100 KB to 200 KB in size.

    owner_id, region, bucket, storage_type, operation, sync_type

    server_latency_level2_10s

    millisecond

    Server-side latency per 10 seconds for files that are 100 KB to 200 KB in size.

    owner_id, region, bucket, storage_type, operation, sync_type

    request_cnt_level1_10s

    Count

    Number of requests per 10 seconds for files smaller than 100 KB.

    owner_id, region, bucket, storage_type, operation, sync_type

    client_latency_level1_10s

    millisecond

    Client-side latency per 10 seconds for files smaller than 100 KB.

    owner_id, region, bucket, storage_type, operation, sync_type

    server_latency_level1_10s

    millisecond

    Server-side latency per 10 seconds for files smaller than 100 KB.

    owner_id, region, bucket, storage_type, operation, sync_type

    request_cnt_level3_10s

    Count

    Number of requests per 10 seconds for files that are 200 KB to 1 MB in size.

    owner_id, region, bucket, storage_type, operation, sync_type

    client_latency_level3_10s

    millisecond

    Client-side latency per 10 seconds for files that are 200 KB to 1 MB in size.

    owner_id, region, bucket, storage_type, operation, sync_type

    server_latency_level3_10s

    millisecond

    Server-side latency per 10 seconds for files that are 200 KB to 1 MB in size.

    owner_id, region, bucket, storage_type, operation, sync_type

    error_timeout_10s

    Count

    Number of timed-out requests per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    delta_add_10s

    byte

    Storage increment per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    delta_del_10s

    byte

    Storage decrement per 10 seconds.

    owner_id, region, bucket, storage_type, operation, sync_type

    top_object_pv_5m

    Count

    Number of visits to top files per 5 minutes.

    owner_id, region, bucket, storage_type, object

    top_object_bandwidth_out_5m

    byte

    Outbound traffic of top files per 5 minutes.

    owner_id, region, bucket, storage_type, object

    top_object_bandwidth_in_5m

    byte

    Inbound traffic of top files per 5 minutes.

    owner_id, region, bucket, storage_type, object

    top_ip_method_pv_5m

    Count

    Number of visits from top IP addresses per 5 minutes.

    owner_id, region, bucket, storage_type, operation, client_ip

    top_ip_method_bandwidth_out_5m

    byte

    Outbound traffic from top IP addresses per 5 minutes.

    owner_id, region, bucket, storage_type, operation, client_ip

    top_ip_method_bandwidth_in_5m

    byte

    Inbound traffic from top IP addresses per 5 minutes.

    owner_id, region, bucket, storage_type, operation, client_ip

    top_ip_storage_pv_5m

    Count

    Number of visits from top IP addresses per 5 minutes.

    owner_id, region, bucket, storage_type, client_ip

    top_ip_storage_bandwidth_out_5m

    byte

    Outbound traffic from top IP addresses per 5 minutes.

    owner_id, region, bucket, storage_type, client_ip

    top_ip_storage_bandwidth_in_5m

    byte

    Inbound traffic from top IP addresses per 5 minutes.

    owner_id, region, bucket, storage_type, client_ip

    top_refer_pv_5m

    Count

    Number of visits from top referers per 5 minutes.

    owner_id, region, bucket, storage_type, refer

    The following table describes the label fields.

    Label field

    Description

    owner_id

    The Alibaba Cloud account ID of the OSS bucket owner.

    region

    The region where the OSS bucket is located.

    bucket

    The name of the OSS bucket.

    object

    The name of the OSS object.

    storage_type

    The storage class of the OSS bucket.

    operation

    The API operation. For more information, see Appendix: API operations.

    sync_type

    The synchronization type.

    client_ip

    The source IP address of the access request.

    refer

    The HTTP Referer of the request.

    Appendix: API operations

    The following table lists the API operations. For more information, see API overview.

    Operation

    Description

    AbortMultiPartUpload

    Aborts a multipart upload.

    AppendObject

    Appends data by uploading a file.

    CompleteUploadPart

    Completes the breakpoint upload.

    CopyObject

    Copies the file.

    DeleteBucket

    Deletes a bucket.

    DeleteLiveChannel

    Deletes a LiveChannel.

    DeleteObject

    Deletes an object.

    DeleteObjects

    Deletes multiple objects.

    ExpireObject

    Deletes an expired object.

    GetBucket

    Lists objects.

    GetBucketAcl

    Gets the access control list (ACL) of a bucket.

    GetBucketCors

    Qets the cross-origin resource sharing (CORS) rules of a bucket.

    GetBucketEventNotification

    Gets the notification configurations of a bucket.

    GetBucketInfo

    Qets the information about a bucket.

    GetBucketLifecycle

    Qets the lifecycle configuration of a bucket.

    GetBucketLocation

    Qets the region of a bucket.

    GetBucketLog

    Qets the access log configuration of a bucket.

    GetBucketReferer

    Qets the hotlink protection settings of a bucket.

    GetBucketReplication

    Qets the cross-region replication (CRR) configuration.

    GetBucketReplicationProgress

    Qets the CRR progress.

    GetBucketStat

    Qets the information about a bucket.

    GetBucketWebSite

    Qets the static website hosting status of a bucket.

    get_image_exif

    Qets the EXIF information of an image.

    get_image_info

    Qets the information about an image, such as its height and width.

    get_image_infoexif

    Qets the height, width, and EXIF information of an image.

    GetLiveChannelStat

    Qets the status information of a LiveChannel.

    GetObject

    Reads the object.

    GetObjectAcl

    Obtains object access permissions.

    GetObjectInfo

    Gets the information about an object.

    GetObjectMeta

    Qets the object meta information.

    GetObjectSymlink

    Gets the details of a symbolic link file.

    GetPartData

    Gets the data of a part in a multipart upload.

    GetPartInfo

    Gets the information about a part in a multipart upload.

    GetProcessConfiguration

    Gets the image processing configuration of a bucket.

    GetService

    Lists buckets.

    get_style

    Gets a bucket style.

    HeadBucket

    Queies the information about a bucket.

    HeadObject

    Views file information.

    InitiateMultipartUpload

    Initiates a multipart upload.

    ListMultiPartUploads

    Lists multipart upload tasks in progress.

    ListParts

    Lists the status of parts in a multipart upload.

    list_style

    Lists the styles of a bucket.

    PostObject

    Uploads an object using a form.

    PostProcessTask

    Submits a data processing task, such as taking a screenshot.

    PostVodPlaylist

    Creates a video-on-demand (VOD) playlist for a LiveChannel.

    ProcessImage

    Processes an image.

    PutBucket

    Creates a bucket.

    PutBucketCors

    Configures the CORS rules for a bucket.

    PutBucketLifecycle

    Configures the lifecycle rules for a bucket.

    PutBucketLog

    Configures access logs for a bucket.

    PutBucketWebSite

    Configures the static website hosting mode for a bucket.

    PutLiveChannel

    Creates a LiveChannel.

    PutLiveChannelStatus

    Sets the status of a LiveChannel.

    PutObject

    Uploads files.

    PutObjectAcl

    Modifies file access permissions.

    PutObjectSymlink

    Creates a symbolic link file.

    put_style

    Creates a bucket style.

    RedirectBucket

    Redirects a bucket endpoint.

    RestoreObject

    Restores the file.

    UploadPart

    Uploads data by part.

    UploadPartCopy

    Copies a part.