Table, as the most common display type of data, is the most basic method to organize data. By organizing the data, table references and analyzes the data quickly. Log Service provides a function similar to the SQL aggregate computing. By default, the results obtained by using the query and analysis syntax are displayed in a table.

Basic components

  • Header
  • Row
  • Column


  • The number of SELECT items is the number of columns.
  • The number of rows is determined by the number of logs after being computed in the current time interval. The default value is LIMIT 100 .


  1. On the query page, enter the query statement in the search box, select the time interval, and then click Search.
  2. Click the Graph tab, the query results are displayed in a table by default.


The raw log is as follows. 

Figure 1. Original log

  1. To obtain the columns hostname , remote_addr , and request_uri of the latest 10 logs, the statement is as follows:
    * | SELECT hostname, remote_addr, request_uri GROUP BY hostname, remote_addr, request_uri LIMIT 10
    Figure 2. case 1

  2. To compute a single data, for example, the average request_time (the average request time) in the current time interval, and retain three decimal places, the statement is as follows:
    * | SELECT round(avg(request_time), 3) as average_request
    Figure 3. case 2

  3. To compute grouped data, for example, the request_method distribution in the current time interval, and display the distribution in descending order, the statement is as follows:
    * | SELECT request_method, count(*) as count GROUP BY request_method ORDER BY count DESC
    Figure 4. case 3