Log Service provides the log analysis feature. This feature allows you to search for log data and use SQL functions to analyze the data. This topic describes the syntax and limits of the analytic statements. This topic also provides SQL functions that you can call when you use the log analysis feature.
- To use the log analysis feature, you must turn on the Enable Analytics switch when you configure indexes for log fields. For more information, see Configure indexes. If you turn on the Enable Analytics switch, you can analyze log data free of charge.
- Log Service provides reserved fields. For information about how to analyze reserved fields, see Reserved fields.
- You do not need to specify the FROM or WHERE clause in an analytic statement. By default, all data of the current Logstore is analyzed.
- You do not need to add a semicolon at the end of an analytic statement to end the statement.
- Analytic statements are case-insensitive.
Search statement|Analytic statement
Statement Description Search statement A search statement specifies one or more search conditions. A condition can be a keyword, a value, a value range, a space character, or an asterisk (*).
If you leave the search statement unspecified or specify an asterisk (*) as the search statement, it indicates that no condition is specified and all log data is returned. For more information, see Search syntax.
Analytic statement An analytic statement is used to aggregate or analyze search results or all data in a Logstore.
* | SELECT status, count(*) AS PV GROUP BY status
|Number of concurrent analytic statements||Each project supports a maximum of 15 concurrent analytic statements at a time.
For example, 15 users can execute analytic statements in all Logstores of a project at the same time.
|Data volume||Each shard supports only 1 GB of data for a single analytic statement.|
|Method to enable||Standard instances are enabled by default.|
|Resource usage fee||Free of charge.|
|Applicable scope||You can analyze only the data that is written to Log Service after the log analysis
feature is enabled.
If you want to analyze historical data, you must re-index the historical data. For more information, see Reindex logs for a Logstore.
|Returned result||After you execute an analytic statement, a maximum of 100 rows of data are returned
If you require more data, use the LIMIT clause. For more information, see LIMIT syntax.
|Size of a field value||The maximum size of a field value is 16 KB. If the size of a field value exceeds 16 KB, the excess content is not analyzed.|
|Timeout period||The maximum timeout period for a single analytic statement is 55 seconds.|
|Number of digits that consists of a field value of the double type||Each field value of the double type consists of a maximum of 52 digits.
If the number of digits is greater than 52, the accuracy of the field value is compromised.
Analytic functions and syntax
This section lists the Analytic functions and syntax that Log Service supports.
- SQL functions
- General aggregate functions
- Security check functions
- Map functions
- Approximate functions
- Mathematical statistics functions
- Mathematical calculation functions
- String functions
- Date and time functions
- URL functions
- Regular expression functions
- JSON functions
- Type conversion functions
- IP functions
- Array functions
- Binary string functions
- Bitwise functions
- Interval-valued comparison and periodicity-valued comparison functions
- Comparison functions and operators
- Lambda functions
- Logical functions
- Geospatial functions
- Geo functions
- Machine learning syntax and functions
- Window functions
- Machine learning functions
- Smooth functions
- Multi-period estimation functions
- Change point detection functions
- Maximum value detection functions
- Prediction and anomaly detection functions
- Sequence decomposition function
- Time series clustering functions
- Frequent pattern statistical function
- Differential pattern statistical function
- Request URL classification function
- Root cause analysis function
- Correlation analysis functions
- Kernal density estimation functions
- Time series padding function
- Anomaly comparison function
- SQL syntax
Sample analysis results
The following figure shows a sample dashboard that visualizes the analysis results.