An index is an inverted storage structure that consists of keywords and logical pointers that can refer to actual data. You can use an index to quickly locate data rows based on keywords. An index is similar to a data catalog. You can query and analyze log data only after you configure indexes.
Prerequisites
Usage notes
- After you enable the indexing feature, you are charged for the index traffic and storage space occupied by indexes. For more information, see Billable items.
- After you disable the indexing feature for a Logstore, the storage space occupied by historical indexes is automatically released if the data retention period of the Logstore elapses.
- The indexing feature takes effect only on the log data that is written after you configure indexes. If you want to query and analyze historical data, you must use the reindexing feature. For more information, see Reindex logs for a Logstore.
- By default, indexes are configured for specific reserved fields in Log Service. For
more information, see Reserved fields. No delimiters are specified for the indexes of the
__topic__
and__source__
fields. When you search for the fields, only exact match is supported. - If you want to search for the fields that are prefixed with __tag__, you must configure field indexes. Full-text indexes are not supported.
Index types
The following table describes the index types supported by Log Service.
Index type | Description |
---|---|
Full-text index | Log Service splits an entire log into multiple words based on specified delimiters
to create indexes. In a search statement, the field names (keys) and field values
(values) are both plain text. For example, the search statement error returns the logs that contain the keyword error .
|
Field index | After you configure field indexes, you can specify field names and field values in
the Key:Value format to search for logs. For example, the search statement level:error returns the logs whose level field value contains error .
If you want to use the analysis feature, you must configure field indexes and turn on Enable Analytics for the required fields. If you turn on Enable Analytics, no additional index traffic is generated, and no additional storage space is occupied. |
Configure full-text indexes
Configure field indexes
Enable the automatic update of indexes
If a Logstore is a dedicated Logstore for a cloud service or an internal Logstore, Auto Update is turned on by default. The built-in indexes of the Logstore are automatically updated to the latest version.

Index traffic descriptions
After you configure indexes, index traffic is generated.
Index type | Description |
---|---|
Full-text index | All field names and field values are stored as text. The field names and field values are both included in the index traffic. |
Field index | The method that is used to calculate index traffic varies based on the data type of
a field.
|