This topic describes the common error messages that are returned when you query and analyze log data in the Log Service console and provides solutions to the errors.

line 1:44: Column 'XXX' cannot be resolved;please add the column in the index attribute

  • Cause

    No index is configured for the XXX field.

  • Solution

    Configure an index and enable the analysis feature for the field. For more information, see Configure indexes.

ErrorType:QueryParseError.ErrorMessage:syntax error error position is from column:10 to column:11,error near < : >

  • Cause

    The syntax of the query statement is invalid. The position of the invalid syntax is near the colon (:).

  • Solution

    Check and modify the query statement, and then execute the query statement.

Column 'XXX' not in GROUP BY clause;please add the column in the index attribute

  • Cause

    You can specify a GROUP BY clause in a SELECT statement to perform aggregate calculations. In the SELECT statement, you can specify only a column that is specified in the GROUP BY clause or specify a random column that is excluded from the GROUP BY columns as an argument in an aggregate function. For example, * | SELECT status, request_time, COUNT(*) AS PV GROUP BY status is an invalid query statement because request_time is not a GROUP BY column.

  • Solution

    Check and modify the query statement, and then execute the query statement. In contrast to the preceding query statement, the following query statement is valid: * | SELECT status, arbitrary(request_time), count(*) AS PV GROUP BY status. For more information, see GROUP BY clause.

sql query must follow search query,please read syntax doc

  • Cause

    The syntax of the query statement is invalid because only an analytic statement is specified. In Log Service, you must specify an analytic statement together with a search statement in the Search statement|Analytic statement format.

  • Solution

    Add a search statement prior to the analytic statement, for example, * | SELECT status, count(*) AS PV GROUP BY status. For more information, see Syntax.

line 1:10: identifiers must not start with a digit; surround the identifier with double quotes

  • Cause

    The syntax of the analytic statement is invalid because the column name or variable name that is specified in the analytic statement starts with a digit. A column name in an SQL statement can contain only letters, digits, and underscores (_). The column name must start with a letter.

  • Solution

    Change the alias. For more information, see Column aliases.

line 1:9: extraneous input ‘’ expecting

  • Cause

    Extra Chinese quotation marks are specified in the query statement.

  • Solution

    Check and modify the query statement, and then execute the query statement.

key (XXX) is not config as key value config,if symbol : is in your log,please wrap : with quotation mark "

  • Cause

    No index is configured for the XXX field, or the field that you specify contains special characters such as space characters and is not enclosed in double quotation marks ("").

  • Solution
    • Configure an index and enable the analysis feature for the field. For more information, see Configure indexes.
    • Enclose the field in double quotation marks ("").

Query exceeded max memory size of 3GB

  • Cause

    The size of the memory that is used by the query statement exceeds 3 GB. The issue occurs because a large number of values are returned in the query and analysis result after you use a GROUP BY clause to remove duplicates.

  • Solution

    Optimize the GROUP BY clause. Reduce the number of fields that are specified in the GROUP BY clause.

ErrorType:ColumnNotExists.ErrorPosition,line:0,column:1.ErrorMessage:line 1:123: Column 'XXX' cannot be resolved; it seems XXX is wrapper by ";if XXX is a string ,not a key field, please use 'XXX'

  • Cause

    XXX is not an indexed field and cannot be enclosed in double quotation marks (""). If you want to use a string in an analytic statement, you must enclose the string in single quotation marks (''). Strings that are not enclosed or enclosed in double quotation marks ("") indicate field names or column names.

  • Solution
    • If you want to analyze the XXX field, make sure that you configure an index and enable the analysis feature for the field. For more information, see Configure indexes.
    • If XXX is a string, you must enclose the string in single quotation marks ('').

user can only run 15 query concurrently

  • Cause

    More than 15 analytic statements are executed at the same time. Each project supports a maximum of 15 concurrent analytic statements.

  • Solution

    Reduce the number of concurrent requests to execute multiple search statements based on your business requirements.

unclosed string quote

  • Cause

    The double quotation marks (") in the query statement are incomplete.

  • Solution

    Check and modify the query statement, and then execute the query statement.

error after :.error detail:error after :.error detail:line 1:147: mismatched input 'in' expecting {<EOF>, 'GROUP', 'ORDER', 'HAVING', 'LIMIT', 'OR', 'AND', 'UNION', 'EXCEPT', 'INTERSECT'}

  • Cause

    The invalid keyword in is specified.

  • Solution

    Check and modify the query statement, and then execute the query statement.

Duplicate keys (XXX) are not allowed

  • Cause

    Duplicate indexes are configured for fields.

  • Solution

    Check the index configurations. For more information, see Configure indexes.

only support * or ? in the middle or end of the query

  • Cause

    Wildcards are not used in the expected positions when you perform a fuzzy search.

  • Solution
    Check and modify the wildcards in the query statement. Take note of the following rules:
    • You can add an asterisk (*) or a question mark (?) as a wildcard to the middle or end of a keyword to perform a fuzzy search.
    • A keyword cannot start with an asterisk (*) or a question mark (?).
    • The long and double data types do not support asterisks (*) or question marks (?) in fuzzy searches.

logstore (xxx) is not found

  • Cause

    The XXX Logstore does not exist or no index is configured.

  • Solution

    Check whether the Logstore exists. If the Logstore exists, you must configure an index for at least one field and enable the analysis feature for the Logstore.

condition number 43 is more than 30

  • Cause

    The number of fields that are specified in the search statement is 43. Only a maximum of 30 fields can be specified in a search statement.

  • Solution

    Modify the search statement to reduce the number of specified fields and make sure that the number of fields is less than or equal to 30.

ErrorType:SyntaxError.ErrorPosition,line:1,column:19.ErrorMessage:line 1:19: Expression "data" is not of type ROW

  • Cause

    The data type of the field that is specified in the query statement is invalid.

  • Solution

    Check and modify the query statement, and then execute the query statement.