Indexes are used in a storage structure to sort one or more columns of log data. You can query and analyze log data only after you configure indexes. Query and analysis results vary based on index configurations. Therefore, you must configure indexes based on your business requirements. If you configure both full-text indexes and field indexes, the configurations of the field indexes take precedence.
Prerequisites
- After you enable the indexing feature, you are charged for the index traffic and storage space occupied by indexes. For more information, see Billable items.
- The indexing feature takes effect only on the log data that is written after you configure indexes. If you want to query and analyze historical data, you must use the reindexing feature. For more information, see Reindex logs for a Logstore.
- By default, indexes are configured for specific reserved fields in Log Service. For
more information, see Reserved fields. No delimiters are specified for the indexes of the
__topic__
and__source__
fields. When you search for the fields, only exact match is supported. - If you want to search for the fields that are prefixed with __tag__, you must configure field indexes. Full-text indexes are not supported.
Index types
The following table describes the index types supported by Log Service.
Index type | Description |
---|---|
Full-text index | Log Service splits an entire log into multiple words based on specified delimiters
to create indexes. In a search statement, the field names (keys) and field values
(values) are both plain text. For example, the search statement error returns the logs that contain the keyword error .
|
Field index | After you configure field indexes, you can specify field names and field values in
the Key:Value format to search for logs. For example, the search statement level:error returns the logs whose level field value contains error .
If you want to use the analysis feature, you must configure field indexes and turn on Enable Analytics for the required fields. If you turn on Enable Analytics, no additional index traffic is generated, and no additional storage space is occupied. |
Configure full-text indexes
Configure field indexes
Index traffic descriptions
After you configure indexes, index traffic is generated.
Index type | Description |
---|---|
Full-text index | All field names and field values are stored as text. The field names and field values are both included in the index traffic. |
Field index | The method that is used to calculate index traffic varies based on the data type of
a field.
|