Cloud Log Service provides a set of query syntax to set query condition statements, through which query condition statements can be used to query logs more effectively. For the introduction to query operations, see Log Query.

Query Modes

A query condition statement is used to specify the filtering rules for log search, and to query and return log data that meets the condition in the statement. The following is an introduction to the various query methods provided by Cloud Log Service and examples of query statements.

Query Modes	Details	Example
Full-text Fuzzy Search	In the quick mode, you can directly enter the keywords, and the log service searches for logs that contain the keywords in the original text based on the keywords you entered.	ERROR Search for logs containing the keyword "ERROR" in the original text
Field Search	In the statement mode, you can specify the field name and field value (key = value) to search, and the search content is filtered based on the where condition in SQL. Depending on the data type set in the field index, you can perform multiple types of basic and combined searches.	request_time>60 and request_method='GET' means searching for logs with a request_time field value greater than 60 and a request_method field value GET. request_method= '' means searching for logs with a request_method field value left empty. not request_method= 'GET' means searching for logs that do not contain the request_method field with a request_method field value being not GET.
Field Fuzzy Search	In the statement mode, field fuzzy search (key like value) is supported. value can contain keywords for fuzzy search, that is, percent signs (%) or underlines (_). Log Service will search for words that meet the conditions in all logs and return all logs that contain these words and meet the search conditions.	request_method like 'GE%' means searching all logs for words with a request_method field value starting with GE and returning the logs containing these words.
Range Search	In the statement mode, fields of the double data type support range searches. Method 1: Search for logs using operators such as = (equal to), > (greater than), < (less than), >= (greater than or equal to), and <= (less than or equal to). Method 2: Search for logs using "between xx and xx"	request_time>=60 means searching all logs for logs with a request_time field value greater than or equal to 60. request_time between 60 and 120 means searching all logs for logs with a request_time field value greater than or equal to 60 and less than or equal to 120.

Description

Full-text Fuzzy Search

In this mode, it is not allowed to connect multiple keywords with operators.
In this mode, it is not allowed to use wildcard characters for fuzzy matching.

Field Search

If the key is of text type, the value is a string, and the string content needs to be enclosed in single quotes.
The value parameter cannot be empty. The search statement key='' can match logs with empty field values.
When field search is used with the "not" operator, logs that do not contain the field will also be matched as the results.

Field Fuzzy Search

The value string needs to be enclosed in single quotes.
The percent sign (%) represents zero or more characters. For example, 'g%' will match any string starting with the letter 'g', such as 'get'.
An underline (_) represents a single character. For example, '_e%' will match any string containing 'e' as the second character, such as 'get' or 'setting'.
The double data type does not support fuzzy searches using the percent sign (%) or underline (_).
message is a built-in field corresponding to the original log text, and full-text fuzzy search can be implemented with __message__like '%GET%'.

Operator

Query statements support the following operators:

Operator	Description	Example
and	AND operator. case-insensitive.	abc = 123 and abc = 456
or	OR operator, case-insensitive.	abc = 123 or abc = 456
not	Not operator, case sensitive. When not is used as an operator, use a space before and after it. When field search is used together with the not operator, logs that do not contain the field are matched.	not abc = 123
( )	Logical grouping operator. Controls the priority of logical operations.	(abc = 123 or abc = 456) and status = 200
\	Escape symbol. The escaped character represents the symbol itself. When the retrieved value contains ('), (%), or ( _ ), it needs to be escaped.	Escape ('): abc = 'status:'200'' Escape (%): abc like 'status:%200%'
>	Range operator. Indicates that the value of a field is greater than a certain value and is only applicable to fields of the double type.	abc > 123
>=	Range operator. Indicates that the value of a field is greater than or equal to a certain value and is only applicable to fields of the double type.	abc >= 123
<	Range operator. Indicates that the value of a field is less than a certain value and is only applicable to fields of the double type.	abc < 123
<=	Range operator. Indicates that the value of a field is less than or equal to a certain value and is only applicable to fields of the double type.	abc <= 123
=	Range operator. Indicates that the value of a field is equal to a certain value and is only applicable to fields of the double type.	abc = 123
in	Allows specifying multiple values. It is the abbreviation of multiple OR conditions.	abc in (value1, value2)

Example Query Statements

The following are examples of commonly used query statements.

Common Query Examples

Query Requirement	Statement
Search for logs of POST requests with the 200 status code.	request_method = 'POST' and status = 200
Search for logs of successful GET requests or POST requests (status code 200 to 299).	(request_method = 'POST' or request_method = 'GET') and status between 200 and 299
Search for logs of failed GET requests or POST requests.	(request_method = 'POST' or request_method = 'GET') and not status between 200 and 299
Search for logs of non-GET requests.	request_method != 'GET'
Search for logs of successful GET requests with a time of less than 60 seconds.	request_method = 'GET' and request_time < 60
Search for logs with a request time of 60 seconds.	request_time = 60
Search for logs with a request time greater than or equal to 60 seconds and less than 200 seconds.	request_time >= 60 and request_time < 200
Search for logs whose full text contains "and".	__message__like '%and%'
Search for logs with the "user" field value empty.	user = ''
Search for non-INFO level logs.	not level= 'INFO'

Examples of Advanced Fuzzy Queries

Query Requirement	Query Statement
Search for logs whose original text begins with "GE".	__message__like 'GE%'
Search for logs whose original text begins with "GE" and ends with only one character as a word.	__message__like 'GE%'
Search for logs whose request_method field value starts with "G".	request_method like 'G%'
Search for logs whose request_method field value starts with "P", and ends with "T", with a single character as a word in the middle.	request_method like 'P_T'
Search for logs whose request_method field value starts with "P", and ends with "T", with zero, a single, or multiple characters as a word in the middle.	request_method like 'P%T'

Cloud Log Service

Query Syntax