Simple Log Service:How do I resolve common errors that may occur when I query and analyze logs?

Cause

No index is configured for the XXX field.

Solution

Configure an index and enable the log analysis feature for the field. For more information, see Create indexes.

Cause

The syntax of the query statement is invalid. The position of the invalid syntax is near the colon (:).

Solution

Check and modify the query statement, and execute the new query statement.

Cause

If you use the GROUP BY clause in an analytic statement, the system can query only a column that is included in the GROUP BY clause or perform aggregation on an arbitrary column when the system executes the SELECT statement. For example, * | SELECT status, request_time, COUNT(*) AS PV GROUP BY status is an invalid analytic statement because request_time is not a GROUP BY column.

Solution

Modify the query statement and execute the new query statement. In contrast to the preceding query statement, the following query statement is valid: * | SELECT status, arbitrary(request_time), count(*) AS PV GROUP BY status. For more information, see GROUP BY clause.

Cause

Only an analytic statement is specified. In Simple Log Service, an analytic statement must be used together with a search statement in the Search statement|Analytic statement format.

Solution

Add a search statement prior to the analytic statement. Example: * | SELECT status, count(*) AS PV GROUP BY status. For more information, see Syntax.

Cause

The syntax of the analytic statement is invalid because a column name or variable name that is specified in the analytic statement starts with a digit. In compliance with SQL standards, a column name that is specified in an analytic statement can contain letters, digits, and underscores (_) and must start with a letter.

Solution

Change the alias. For more information, see Column aliases.

Cause

Extra Chinese quotation marks are specified in the query statement.

Solution

Check and modify the query statement, and execute the new query statement.

Cause

No field index is configured for the XXX field, or the field that you specify contains special characters such as spaces but is not enclosed in double quotation marks ("").

Solution

1. Check whether a field index is configured for the field and whether the log analysis feature is enabled for the field.

   • If yes, proceed to the next step.

   • If no, configure field indexes and enable the log analysis feature for the field. For more information, see Manually create field indexes.

     If the error is resolved, skip the next step.

2. Enclose the field in double quotation marks ("").

Cause

The size of the memory that is used by the query statement exceeds 3 GB. The error occurs because a large number of values are returned in the query and analysis results after you use a GROUP BY clause to remove duplicates.

Solution

Optimize the GROUP BY clause. Reduce the number of fields that are specified in the GROUP BY clause.

Cause

XXX is not an indexed field and cannot be enclosed in double quotation marks (""). If you want to use a string in an analytic statement, you must enclose the string in single quotation marks (''). Strings that are not enclosed or enclosed in double quotation marks ("") indicate field names or column names.

Solution

• If XXX is a field that you want to analyze, make sure that you configure an index and enable the log analysis feature for the field. For more information, see Create indexes.

• If XXX is a string, you must enclose the string in single quotation marks ('').

Cause

More than 15 analysis operations are concurrently executed. Each project supports up to 15 concurrent analysis operations.

Solution

Reduce the number of concurrent analysis operations based on your business requirements.

Cause

The double quotation marks (") in the query statement are incomplete.

Solution

Check and modify the query statement, and execute the new query statement.

Cause

The invalid keyword in is specified.

Solution

Check and modify the query statement, and execute the new query statement.

Cause

Duplicate indexes are configured for fields.

Solution

Check the index configurations. For more information, see Create indexes.

Cause

Wildcard characters are not used at the expected positions when you perform a fuzzy search.

Solution

Cause

The XXX Logstore does not exist or has no indexes configured.

Solution

Check whether the Logstore exists. If the Logstore exists, you must configure indexes for at least one field and enable the log analysis feature for the field.

Cause

The number of fields that are specified in the search statement is 43. A maximum of 30 fields can be specified in a search statement.

Solution

Modify the search statement and make sure that the number of fields is less than or equal to 30.

Cause

The data type of a field that is specified in the query statement is invalid.

Solution

Check and modify the query statement, and execute the new query statement.

Cause

The field that you want to analyze contains colons (:).

Solution