This topic describes how to query the contextual log entries of a specified log entry in the Log Service console.


  • Logs are collected by Logtail. For more information, see Logtail overview.
    Note The context query feature is supported only for log data that is collected by Logtail.
  • The indexing feature is enabled and configured. For more information, see Configure indexes.

Background information

To perform a context query, you must specify a source server, source file, and a log entry whose context you want to query. You can obtain the log entries before or after the specified log entry that is collected from the log file of the server. This helps you identify and resolve errors.


For example, an online-to-offline (O2O) website records the steps of an order into log entries on the server. These steps include: log on to the website, browse products, select a product, add the product to the shopping cart, place an order, pay for the order, deduct the order amount, and generate the order.

If an order fails, the O&M engineers must locate the cause at the earliest opportunity. If a traditional context query method is used, the O&M engineers must be authorized by an administrator to log on to each server where the O2O application is deployed. After authorization is complete, the O&M engineers must search the servers one by one for the related application log entries based on the order ID. Then, the O&M engineers can locate the failure cause based on the application log entries.

In Log Service, the O&M engineers can perform the following steps to locate the failure cause.
  1. Install Logtail on the server. Create a machine group and configure a log collection file in the Log Service console. Then, enable Logtail to upload incremental log entries to Log Service.
  2. On the search and analysis page in the Log Service console, specify a time range and find the log entry that records the failure based on the order ID.
  3. After you locate the log entry, scroll up until other related log entries are found, for example, a log entry that records a credit card payment failure.


  • You do not need to change the format of application log entries.
  • You can query the context of a log entry from a log file that is collected from a server in the Log Service console. You do not need to log on to the server to query the context.
  • You can specify a time range to locate suspicious log entries before you perform a context query in the Log Service console. This improves troubleshooting efficiency.
  • You do not need to worry about data loss that is caused by insufficient server storage or log file rotation. You can view log data history in the Log Service console at any time.


  1. Log on to the Log Service console.
  2. In the Projects section, click the name of the project that you want to view.
  3. Choose Log Storage > Logstores. On the Logstores tab, click the Logstore that you want to view.
  4. Enter a query statement, select a time range, and then click Search & Analyze.
  5. On the Raw Logs > Raw Data tab, find the log entry whose context you want to query and click Query Logs - 004.
  6. On the page that appears, scroll up and down to view the contextual log entries.
    • To scroll up, click Old.
    • To scroll down, click New.
    • To highlight a keyword, enter the keyword in the Highlight field.
    • To filter out fields, click Filter By. In the dialog box that appears, select the fields in the right pane and click Delete. After the fields are filtered out, the fields are removed from the log entries that are displayed in the Context View pane.
    Context view