The service log feature of Log Service helps you record log data about the operations that are performed on the resources of a project. This feature also provides dashboards that allow you to analyze data in multiple dimensions. You can use this feature to view the service status of Log Service in real time and improve O&M efficiency.

Default configurations

Default configuration item Description
Logstore When the service log feature is enabled for a project, the generated log data is classified and stored in one of the dedicated Logstores. By default, Log Service automatically creates the following two dedicated Logstores:
  • internal-operation_log: stores operation logs. A log corresponds to an API request. By default, log data in the Logstore is retained for 30 days. The billing method for the Logstore is the same as common Logstores.
  • internal-diagnostic_log: stores the consumption delay logs of consumer groups, Logtail heartbeat logs, and the operational logs of jobs. The logs are classified by topic. By default, log data in the Logstore is retained for 30 days. The Logstore is free of charge.
For more information about log types and fields, see Log types.
  • The dedicated Logstores are used to store only the logs generated by Log Service. You cannot write other data to these Logstores. However, you can query, analyze, and consume the data of the dedicated Logstores and configure alert rules.
  • You are charged for log data generated by the service log feature based on the billing methods of Log Service. For more information, see Billable items.
  • If you select Automatic creation (recommended), Log Service automatically creates a project in the same region to store service logs.
  • You can also select another option from the Log Storage Location drop-down list. If you specify a project to store service logs, the specified project must reside in the same region as the project for which the service log feature is enabled.
Shard By default, two shards are created for each Logstore and the automatic sharding feature is enabled. For more information, see Enable automatic sharding.
Log retention period By default, log data is retained for 30 days. You can modify the retention period. For more information, see Manage a Logstore.
Index By default, the indexing feature is enabled for all collected log data. If you no longer need to query and analyze data or configure alert rules, you can click Index Attributes in the upper-right corner of the Search & Analysis page to disable the indexing feature.
Dashboard The following four dashboards are automatically created:
  • Operations Statistics
  • Logtail Collection Statistics
  • Logtail Monitoring
  • Consumer Group Monitoring
For more information about the dashboards, see Service log dashboards.


  • Check whether data is evenly written and consumed among shards

    You can use predefined dashboards to view the data write and consumption trends of shards and check whether data is evenly written or consumed among shards.

    Multiple Logstores in a project may share the same shards. To view the data writes to multiple shards of a Logstore, you can specify the Logstore as a filter condition.

  • Monitor API request status

    You can call API operations to write log data, consume log data, and create projects or Logstores. A log is generated in the internal-operation_log Logstore each time an API operation is called. If an API request fails, the value of the Status field in the generated log is an integer that is greater than 200, for example, 404. You can monitor API requests by viewing the number of logs in which the value of the Status field is greater than 200.

  • View Logtail status

    By default, the following two Logtail-related dashboards are created after you enable the service log feature: Logtail Monitoring and Logtail Collection Statistics. The Logtail Monitoring dashboard helps you monitor Logtail exceptions such as regular expression mismatches and log data parsing failures.