Log Query

Log query refers to the function of filtering and searching log data collected into Cloud Log Service. For example, querying logs containing INFO is one of the most commonly used functions of Cloud Log Service.

Product Features

• Full-text quick query: Perform keyword query on the full text of the log. When the original log text meets the query condition, the log can be queried. For example, you can use the "INFO" keyword to query all logs where "INFO" appears.

• Key-value query: Query the specified fields in logs. When the field meets the query condition, the log can be queried. For example, you can use "request_method = 'POST' and status = 200" to query the logs of POST requests with the status code 200. In addition, key-value query supports interaction mode and statement mode.

o Interaction mode: Set query conditions for fields through visual interaction without writing query condition statements yourself.

o Statement mode: You can write the query condition statements. For statements and the syntax, see Query Syntax.

Procedures

Quick Query

• Go to the Cloud Log Service console, select the target log project and log unit, and click Retrieve Log to enter the retrieval page.

The default query mode is the quick mode. You can directly enter keywords in the input box to query, or you can click on the commonly used content such as INFO, DEBUG, WARN, and ERROR to query.

In the quick mode, the full text of the log will be retrieved based on the keywords you enter. When the original log text contains the keyword, the log can be queried.

• Click the Retrieve/Analyze button to query based on the current query conditions.

Interaction Mode

• Go to the Cloud Log Service console, select the target log project and log unit, and click Retrieve Log to enter the retrieval page.

Switch to the interaction mode.

Click Add Query Condition in the input box.

In the retrieval condition setting page, click on the left to select a field name, and you can select a query condition on the right, including:

• Contain: Return log data when the field content contains the specified value.

• Equal to: Return log data when the field content is the same as the specified value.

• Not equal to: Return log data when the field content is not the same as the specified value.

Each query condition can be set with multiple specified values, and the relationship between multiple values is OR. Click OK to add the query condition.

In interaction mode, you can add multiple query conditions. Click the + button to add. You can choose "and" or "or" to connect multiple query conditions.

• Click the Retrieve/Analyze button to query based on the current query conditions.

Statement Mode

• Go to the Cloud Log Service console, select the target log project and log unit, and click Retrieve Log to enter the retrieval page.

Switch to the statement mode.

• Write a query statement and click the Retrieve/Analyze button to query based on the current conditions. For query statements and the syntax, see Query Syntax.

Time Range Search

You can select a time range in the upper right corner of the page to query log data based on the selected time range. The default range is the last six hours.

There are three types of time ranges, namely relative time, hourly time, and custom time. You can choose the time range based on your actual needs.

• Relative time: queries log data generated within a time range (e.g., 5 minutes and 1 hour) from the current time. For example, if the current time is 20:10:05, and the relative time is set to one hour, it means to query the log data from 19:10:05 to 20:10:05. Relative time can be selected directly on the left side of the time selection area.

• Custom: queries log data within a specified time range. Custom time can be set on the right side of the area.

Query Results

Cloud Log Service provides log count statistics, raw data and table data to display query results.

• Log count statistics: The log count histogram of the raw data mainly shows the distribution of the queried logs in different time periods. When you hover the mouse over a data block, you can view the time range and number of log hits represented by the data block.

Raw log: The raw log tab displays the results of the current query. Click on the raw log to view the log details.

The query fields or content are highlighted, and you can quickly locate the log information based on the query results for further processing.

• Table log: The table log tab displays the details of the current query results.

Contextual Query

This section describes how to view the context information of a specified log in the raw log file on Cloud Log Service console.

Before You Begin

• You have created log projects, log units and collection rules.

• Logs have been collected.

Background

Contextual query in a log is to specify the log source and one of the logs, and retrieve the first few logs (above) or the last few logs (below) of the logs in the original file at the same time. By viewing the context information of the specified logs, you can quickly find relevant fault information during business troubleshooting, which helps you quickly locate issues and resolve various faults.

Feature Strength

The advantages of contextual query are mainly its understanding and analysis of log data. When you retrieve logs, providing contextual information can significantly improve the performance of your queries and the quality of data analysis.

• When troubleshooting, you can use contextual queries to understand the context and causes and consequences of an event or error.

• Cloud Log Service is independent. You do not need to change the log file format or log in to the server to view the context of the specified log in a file.

• Cloud Log Service frees you from concerns of data loss due to insufficient server storage space or log file overwriting. You can view data history at any time in the Cloud Log Service console.

Procedure

• Log in to the Cloud Log Service console. Select the target log project and log unit, and click Retrieve Log to enter the search page.

• Query target fields, such as ERROR information, using the quick mode or interaction mode.

• On the original page, under the Raw Log tab, locate the target log and click the Contextual Query icon.

• Use the mouse to scroll up and down on the current page to view the contextual information of the specified log.

• Select a time range to quickly filter log information in the preceding and following time periods.

• Enter a keyword in the search box to highlight the keyword in the logs, making it easier to observe the required log content.

• Tip: Up to 500 pieces of data can be loaded for contextual queries.