Overview

This topic describes how to troubleshoot common errors that occur when you query and analyze logs in the log service console.

Description

Common errors in log query and analysis and corresponding solutions are as follows:

 

Error message

Cause

Processing methods

line 1:44: Column 'my_key_field' cannot be resolved;please add the column in the index attribute

my_key_field you cannot reference this Key in Query because it does not exist.

In log Service Console on the search page that appears, click query /analysis to add this field as a field index and enable the statistics function.

Column 'xxxxline' not in GROUP BY clause;please add the column in the index attribute

You use the GROUP BY syntax in the query, but the GROUP BY Select is referenced in a non- agg field that does not appear in GROUP BY. For example: select key1, avg(latency) group by key2, key1 does not appear in GROUP BY.

Please execute select key1,avg(latency) group by key1,key2 command to query.

sql query must follow search query,please read syntex doc

You do not include a filtering condition in a query statement, for example, select ip,count(*) group by ip.

An example correct statement is *|select ip,count(*) group by ip.

please read syntex document,and make sure all related fields are indexed. error after select .error detail:line 1:10: identifiers must not start with a digit; surround the identifier with double quotes

Column names and variables referenced in SQL statements start with a number and do not comply with the rules.

Change the name so the name starts with a letter.

please read syntax document,and make sure all related fields are indexed. error after select .error detail:line 1:9: extraneous input '' expecting

Misspelled words.

Correct the error according to the position indicated in the error.

key (category) is not config as key value config,if symbol : is in your log,please wrap : with quotation mark "

Category the field is not configured with a field index and cannot be used in analysis statements.

You can configure an index for this field in the query and analysis properties. For more information, see enable and configure indexes.

Query exceeded max memory size of 3GB

The size of memory used by the current Query exceeds 3GB. This is usually because the GROUP BY syntax deduplication value too much. Please optimize GROUP BY query Syntax, reducing GROUP BY the number of keys.

ErrorType:ColumnNotExists.ErrorPosition,line:0,column:1.ErrorMessage:line 1:123: Column '__raw_log__' cannot be resolved; it seems __raw_log__ is wrapper by ";if __raw_log__ is a string ,not a key field, please use '__raw_log__'

__raw_log__ you cannot reference this Key in Query because it does not exist.

In log Service Console on the search page that appears, click query /analysis to add this field as a field index and enable the statistics function.

Application scope

  • Log Service for WAF