Indexes are used in a storage structure to sort one or more columns of log data. You can query and analyze data only after you configure indexes. Query and analysis results vary with index configurations. Therefore, you must configure indexes based on your business requirements.
Prerequisites
Index types
The following table describes the index types in Log Service.
Index type | Description |
---|---|
Full-text index | Log Service splits an entire log entry into multiple words based on specified delimiters.
In a query, specified field names (keys) or field values (values) are normal text.
For example, the search statement error returns the log entries that contain the keyword error .
|
Field index | After you configure field indexes, you can query log entries. To query log entries,
specify field name and field value as key-value pairs in the format of key:value.
For example, the search statement level:error returns the log entries in which the value of the level field contains error .
If you want to use the analysis feature, you must configure field indexes and turn on the Enable Analytics switch for the related fields. The analysis feature does not incur additional index traffic or occupy storage space. |
- After you enable the indexing feature, index traffic and storage space occupied by indexes incur fees. For more information, see Billing overview.
- The indexing feature is applicable only to the log data that is written to the current Logstore after you configure indexes. If you want to query and analyze historical data, you can use the reindexing feature. For more information, see Reindex logs for a Logstore.
- If you configure full-text indexes and field indexes, the configurations of the field indexes take precedence.
- By default, indexes are automatically configured for some reserved fields in Log Service.
For more information, see Reserved fields. By default, no delimiter is specified to split the values of the
__topic__
and__source__
fields. Therefore, only exact match is supported for the two fields.