Table, as the most common display type of data, is the most basic method to organize data. By organizing the data, table references and analyzes the data quickly. Log Service provides a function similar to the SQL aggregate computing. By default, the results obtained by using the query and analysis syntax are displayed in a table.

Basic components

  • Header
  • Row
  • Column

Wherein:

  • The number of SELECT items is the number of columns.
  • The number of rows is determined by the number of logs after being computed in the current time interval. The default value is LIMIT 100 .

Procedure

  1. On the query page, enter the query statement in the search box, select the time interval, and then click Search.
  2. Click the Graph tab, the query results are displayed in a table by default.

Example

The raw log is as follows. 

Figure 1. Original log


  1. To obtain the columns hostname , remote_addr , and request_uri of the latest 10 logs, the statement is as follows:
    * | SELECT hostname, remote_addr, request_uri GROUP BY hostname, remote_addr, request_uri LIMIT 10
    Figure 2. case 1


  2. To compute a single data, for example, the average request_time (the average request time) in the current time interval, and retain three decimal places, the statement is as follows:
    * | SELECT round(avg(request_time), 3) as average_request
    Figure 3. case 2


  3. To compute grouped data, for example, the request_method distribution in the current time interval, and display the distribution in descending order, the statement is as follows:
    * | SELECT request_method, count(*) as count GROUP BY request_method ORDER BY count DESC
    Figure 4. case 3