A Logstore in Log Service is used to collect, store, and query logs. This topic describes the types of Logstores and the operations that you can perform on a Logstore.

Overview

Log Service provides two types of Logstores: Standard Logstores and Query Logstores.
  • Standard Logstore: This type of Logstore supports the log analysis feature and is suitable for scenarios such as real-time monitoring and interactive analysis. You can use this type of Logstore to build a comprehensive observability system.
  • Query Logstore: This type of Logstore supports high-performance queries. The index traffic fee of a Query Logstore is lower than that of a Standard Logstore. Query Logstores do not support SQL analysis. Query Logstores are suitable for scenarios in which the volume of data is large, the log retention period is long, or log analysis is not required. Log retention periods of weeks or months are considered long.

Logstore comparison by type

ItemStandard LogstoreQuery Logstore
FeeIndex trafficUSD 0.0875 per GBUSD 0.0146 per GB
FeatureCollection of business system logsSupportedSupported

Logs of cloud services cannot be collected.

Enable hot and cold-tiered storage for a LogstoreSupportedSupported
Log searchSupportedSupported
Log analysis based on SQL statementsSupportedNot supported
Contextual querySupportedSupported
LiveTailSupportedSupported
LogReduceSupportedNot supported
Reindex logs for a LogstoreSupportedSupported
DashboardSupportedNot supported
AlertingSupportedAlerts can be configured based only on search statements.
Scheduled SQLSupportedNot supported
Data transformationSupportedSupported
Data shippingSupportedSupported
Data consumptionSupportedSupported

Limits

System Logstores and dedicated Logstores for cloud services cannot store irrelevant logs.
  • For example, internal-operation_log is a system Logstore that can store only the detailed logs of Log Service.
  • For example, oss-log-store in a specified project is a dedicated Logstore for Object Storage Service (OSS) that can store only the access logs of OSS.

Create a Logstore

Note You can create up to 200 Logstores in a project.
  1. Log on to the Log Service console.
  2. In the Projects section, click the project that you want to manage.
  3. On the Log Storage > Logstores tab, click the + icon.
  4. In the Create Logstore panel, configure the following parameters.
    ParameterDescription
    Logstore TypeThe type of the Logstore. Log Service provides two types of Logstores: Standard Logstores and Query Logstores. For more information about the differences between the two types of Logstores, see Logstore comparison by type.

    You can upgrade a Query Logstore to a Standard Logstore. For more information, see Method 1.

    Logstore NameThe name of the Logstore. The name must be unique in the project to which the Logstore belongs. After the Logstore is created, you cannot change its name.
    WebTrackingIf you turn on WebTracking, you can collect data from HTML, HTML5, iOS, and Android platforms to Log Service by using the web tracking feature. For more information, see Use the web tracking feature to collect logs.
    Permanent StorageIf you turn on Permanent Storage, Log Service permanently stores the collected logs in the Logstore.
    Note If you query the data retention period by calling an API operation and the returned result is 3650, logs are permanently stored.
    Data Retention PeriodThe retention period of logs in the Logstore. Valid values: 1 to 3000. Unit: days.
    Warning Logs are automatically deleted after the specified retention period ends.

    You can configure the Data Retention Period parameter only if you do not turn on Permanent Storage.

    Important If you shorten the data retention period, Log Service deletes all expired data within 1 hour. The data volume that is displayed for Storage Size(Log) on the homepage of the Log Service console is updated the next day. For example, if you change the value of the Data Retention Period parameter from 5 to 1, Log Service deletes the logs of the previous four days within 1 hour.
    ShardsThe number of shards. Log Service provides shards that allow you to read and write data. Each shard supports a write capacity of 5 MB/s and 500 writes/s and a read capacity of 10 MB/s and 100 reads/s. You can create up to 10 shards in each Logstore. You can create up to 200 shards in each project. For more information, see Shard:

    By default, two shards are created when you create a Logstore. For more information about the billing of shards, see Why am I charged for active shards? .

    Automatic ShardingIf you turn on Automatic Sharding, Log Service increases the number of shards when the existing shards cannot accommodate the data that is written. For more information, see Manage shards.
    Maximum ShardsIf you turn on Automatic Sharding, you must configure this parameter to specify the maximum number of readwrite shards that can be created. Maximum value: 256.
    Log Public IPIf you turn on Log Public IP, Log Service adds the following information to the Tag field of the collected logs:
    • __client_ip__: the public IP address of the log source.
    • __receive_time__: the time at which Log Service receives the log. The value is a UNIX timestamp representing the number of seconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.
  5. Click OK.

Modify the configurations of a Logstore

  1. On the Log Storage > Logstores tab, move the pointer over the Logstore whose configurations you want to modify and choose Modify Logstore > Modify.
  2. On the Logstore Attributes page, click Modify.
    For more information about the parameters, see Create a Logstore.
  3. Click Save.

Upgrade the specifications of a Logstore

You can upgrade a Query Logstore to a Standard Logstore. You can upgrade the specifications of a Logstore on the Logstore Attributes page. You can also follow the on-screen instructions to upgrade the specifications of a Logstore when you perform analysis operations.

Important
  • After the upgrade, Enable Analytics is automatically turned on for the current fields. You can analyze only the logs that are written to Log Service after the log analysis feature is enabled. You can turn on Enable Analytics to enable the feature.

    If you enable the log analysis feature, fees are not generated for the index traffic of historical data.

  • After the upgrade, you are charged for the index traffic of new logs that are written to Log Service. The index traffic fee is calculated based on the index traffic of log data billable item. For more information, see Billable items.

Method 1

  1. On the Log Storage > Logstores tab, move the pointer over the Logstore whose specifications you want to upgrade and choose Modify Logstore > Modify.
  2. On the Logstore Attributes page, click Modify.
  3. Find Logstore Type and click Upgrade.
  4. In the message that appears, click Confirm.
  5. Click Save.

Method 2

When you configure an index for a Logstore, click the switch in the Enable Analytics column. Then, you are prompted to upgrade the specifications of the Logstore. You can click Upgrade Now to complete the upgrade. For more information about index configurations, see Create indexes. Upgrade the specifications of a Logstore

Method 3

On the Quick Analysis tab of a Logstore, click the field that you want to manage. Then, you are prompted to upgrade the specifications of the Logstore. You can click Upgrade Now to complete the upgrade. For more information about the quick analysis feature, see Quick analysis. Upgrade the specifications of a Logstore

Delete a Logstore

Important
  • Before you can delete a Logstore, you must delete all Logtail configurations that are associated with the Logstore. For more information, see Delete Logtail configurations.
  • If the log shipping feature is enabled for the Logstore, we recommend that you stop writing data to the Logstore and make sure that all data in the Logstore is shipped before you delete the Logstore.
  • If you delete all Logstores, you are still charged for data storage on the day that you delete the Logstores, but no charges are incurred from the following day. As a result, from the third day after you delete all Logstores, you no longer receive a Log Service bill.
  1. On the Log Storage > Logstores tab, move the pointer over the Logstore that you want to delete and choose Modify Logstore > Delete.
    Warning After you delete a Logstore, all logs in the Logstore are deleted and cannot be restored. Proceed with caution.
  2. In the Delete message, click OK.

Delete logs

Logs are automatically deleted after the specified retention period ends. To delete logs, you can modify Data Retention Period.

Important If you shorten the data retention period, Log Service deletes all expired data within 1 hour. The data volume that is displayed for Storage Size(Log) on the homepage of the Log Service console is updated the next day. For example, if you change the value of the Data Retention Period parameter from 5 to 1, Log Service deletes the logs of the previous four days within 1 hour.

Enable hot and cold-tiered storage for a Logstore

You can enable the hot and cold-tiered storage feature for a Logstore on the Logstore Attributes page in the Log Service console. For more information, see Enable hot and cold-tiered storage for a Logstore.

Logstore-related API operations

ActionAPI operation
Create a LogstoreCreateLogStore
Delete a LogstoreDeleteLogStore
Query a Logstore
Modify a LogstoreUpdateLogStore