All Products
Search
Document Center

Simple Log Service:GetLogs

Last Updated:Jul 30, 2026

Queries log data in a specified Logstore of a specified Project. This operation is deprecated. Use the GetLogsV2 operation instead.

Operation description

Operation description

Note

Simple Log Service allows you to create scheduled SQL nodes. For more information, see Create a scheduled SQL node.

  • The Host in the request syntax consists of the Project name and the Simple Log Service endpoint. You must specify the Project in the Host.

  • Create and obtain an AccessKey pair. For more information, see AccessKey pair.

An Alibaba Cloud account AccessKey pair has access permissions on all API operations, which poses high security risks. We strongly recommend that you create and use a Resource Access Management (RAM) user for API access or routine O&M. The Resource Access Management (RAM) user must have access permissions to manage Simple Log Service EPS resources. For more information, see Create a RAM user and authorize the RAM user.

  • Determine the Project name, region, and Logstore name for the logs you want to query. For more information, see Manage a Project and Manage a Logstore.

  • Simple Log Service has usage limits for querying logs. Design proper query and analytic statements and set proper query time ranges. For more information, see Limits on log queries and Limits on log analysis.

  • Before you query logs, configure indexes. For more information, see Create indexes.

  • When the number of logs involved in a query changes significantly, the Simple Log Service API cannot predict how many times this operation must be invoked to obtain complete results. Check the x-log-progress status value in the response of each request to determine whether you need to invoke this operation again to obtain complete results. Each repeated invocation consumes the same number of query compute units (CUs).

  • After logs are written to a Logstore, the latency before the query operations (GetHistograms and GetLogs) can query the logs varies based on the log type. Simple Log Service classifies logs into the following two types based on log UNIX timestamps:

    • Real-time data: The time point in the log is within the range of (-180 seconds, 900 seconds] relative to the current time on the server. For example, if the log time is UTC 2014-09-25 12:03:00 and the server receives the log at UTC 2014-09-25 12:05:00, the log is processed as real-time data. This generally occurs in normal scenarios.

    • Historical data: The time point in the log is within the range of [-7×86400 seconds, -180 seconds) relative to the current time on the server. For example, if the log time is UTC 2014-09-25 12:00:00 and the server receives the log at UTC 2014-09-25 12:05:00, the log is processed as historical data. This generally occurs in data backfill scenarios. The latency from writing real-time data to querying the data is approximately 3 seconds.

Note

Simple Log Service calculates the difference between the log time (field name: time) and the server receive time (field name: tag:receive_time). If the difference is within the range of (-180 seconds, 900 seconds], the log is real-time data. If the difference is within the range of [-7×86400 seconds, -180 seconds), the log is historical data.

Authentication resources

The following table lists the authorization information corresponding to this API operation. You can add this information to the Action element of a RAM access policy statement to grant a Resource Access Management (RAM) user or RAM role the authorization to invoke this API operation.

ActionResource
log:GetLogStoreLogsacs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request syntax

POST /logstores/{logstore}/logs HTTP/1.1

Path Parameters

Parameter

Type

Required

Description

Example

logstore

string

Yes

The name of the Logstore from which you want to query data.

example-logstore

Request parameters

Parameter

Type

Required

Description

Example

project

string

Yes

The name of the Project.

ali-test-project

No

lz4

No

Response elements

Element

Type

Description

Example

array

The log array. Each element is a log entry.

object

The Logs array. Each element in the array is a log entry.

[{'remote_addr': '198.51.XXX.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'}, {'remote_addr': '198.51.XXX.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'}, {'remote_addr': '198.51.XXX.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'}, {'remote_addr': '198.51.XXX.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'}, {'remote_addr': '198.51.100.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'}]

Examples

Success response

JSON format

[
  {
    "test": "test",
    "test2": 1
  }
]

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.