Log Service allows you to search for 1 billion lines of log data at a time within 1 second. This topic describes the syntax and limits of the log search feature and how to use the syntax.
- A search statement can be executed alone. However, an analytic statement must be executed together with a search statement. The log analysis feature is based on search results or all data in a Logstore.
- If you need to search for tens of billions of lines, you can repeatedly execute a search statement up to 10 times to obtain the complete result.
Search statement|Analytic statement
Statement Description Search statement A search statement specifies one or more search conditions and returns the log entries that meet the specified conditions.
A condition can be a keyword, a value, a value range, a space character, or an asterisk (*). If you leave the search statement unspecified or specify an asterisk (*) as the search statement, it indicates that no condition is specified and all log data is returned. For more information, see Search syntax.
Analytic statement An analytic statement is used to aggregate or analyze a search result. For more information, see Log analysis.
* | SELECT status, count(*) AS PV GROUP BY status
- Each project supports up to 100 concurrent search statements at a time.
For example, 100 users can concurrently search for data in all Logstores of a project at the same time.
- You can specify up to 30 keywords for each search statement.
- The maximum size of a field value to search for is 10 KB.
- The returned log entries are displayed on multiple pages. Each page displays up to 100 search results.
- Log Service performs the DOM operation only on the first 10,000 characters of a single log entry.
- If you perform a fuzzy search, Log Service searches log entries for 100 words that meet the specified conditions. Log entries that contain the 100 words and meet the search conditions are returned.
- Use the Log Service console
- Call API operations