Analyze Log4j logs in Simple Log Service using an e-commerce scenario as an example.
Prerequisites
Log4j logs are collected. Collect Log4j logs.
Indexes are configured. Create indexes.
In Specified Field Query, add the text fields
level,location,message, andthread, and select Enable Statistics.
Background information
An e-commerce company wants to analyze user behavior, platform stability, errors, and data security. They track login methods, session durations, page views, and spending patterns. Simple Log Service collects, stores, and analyzes this log data.
Sample log entries:
User login:
level: INFO location: com.aliyun.log4jappendertest.Log4jAppenderBizDemo.login(Log4jAppenderBizDemo.java:38) message: User login successfully. requestID=id4 userID=user8 thread: main time: 2022-01-26T15:31+0000User purchase:
level: INFO location: com.aliyun.log4jappendertest.Log4jAppenderBizDemo.order(Log4jAppenderBizDemo.java:46) message: Place an order successfully. requestID=id44 userID=user8 itemID=item3 amount=9 thread: main time: 2022-01-26T15:31+0000
Procedure
Log on to the Simple Log Service console.
In the Projects section, click the one you want.
On the tab, click the logstore you want.
Enter a query statement, and then set the time range by clicking Last 15 Minutes.
For more information, see Step 1: Configure indexes.
Find the top three error locations in the last hour:
level: ERROR | select location ,count(*) as count GROUP BY location ORDER BY count DESC LIMIT 3Count log entries by level in the last 15 minutes:
* | select level ,count(*) as count GROUP BY level ORDER BY count DESCFind the top three users by login count in the last hour:
login | SELECT regexp_extract(message, 'userID=(?<userID>[a-zA-Z\d]+)', 1) AS userID, count(*) as count GROUP BY userID ORDER BY count DESC LIMIT 3Calculate total payments per user in the last 15 minutes:
order | SELECT regexp_extract(message, 'userID=(?<userID>[a-zA-Z\d]+)', 1) AS userID, sum(cast(regexp_extract(message, 'amount=(?<amount>[a-zA-Z\d]+)', 1) AS double)) AS amount GROUP BY userID