Simple Log Service provides the scan-based query feature, allowing you to query and analyze target fields for which indexes have not been created.
Background information
Simple Log Service provides the index-based query feature. However, in some scenarios, indexes cannot be created or used. Examples:
Indexes are not created for some fields, to reduce costs. In this scenario, an urgent need to query historical logs may not be met.
The length of a field value exceeds the upper limit supported by indexes. In this scenario, the excess part cannot be queried.
Many field names are involved and cannot be obtained in advance. In this scenario, field indexes cannot be created.
The type of a field is changed. In this scenario, the field cannot be queried.
To address the above issues, Simple Log Service provides the scan-based query and scan-based analysis features. You can use the features to query and analyze logs without the need to create indexes for the fields that are used for scanning. For more information about the scan-based analysis feature, see Scan-based analysis overview.
The scan-based query feature supports SPL. For more information, see SPL overview. You can use SPL statements to extract structured information from the raw data that is obtained, process fields in the raw data, and filter the raw data. SPL statements support multi-level data processing.
Benefits
Low costs: You do not need to create indexes, and you are not charged for index traffic or index storage.
Flexible implementation: You can specify field types based on your business requirements regardless of whether indexes are created or index types are specified.
Optimized search capability: More functions are supported.
Limits
The execution of SPL statements for scan-based query is limited. For more information, see Limits.
Random page turning is not supported.