Queries raw log data from a specified Logstore in a project and returns raw logs within a specified time range. The results are compressed before transmission.
Operation description
-
Specify the compression method during use. Different programming languages implement different compression algorithms. For details, see the Accept-Encoding request parameter.
-
For more information, see GetLogs.
Authentication
The following table describes the authorization information required by this API. You can add this information to the Action element in a RAM access policy statement to grant a Resource Access Management (RAM) user or RAM role the permission to invoke this API.
| Action | Resource |
log:GetLogStoreLogs | acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName} |
The following procedure describes how to use this API:
Try it now
Test
RAM authorization
Request syntax
POST /logstores/{logstore}/logs HTTP/1.1Path Parameters
|
Parameter |
Type |
Required |
Description |
Example |
| logstore |
string |
Yes |
The Logstore name. |
test-logstore |
Request parameters
|
Parameter |
Type |
Required |
Description |
Example |
| project |
string |
Yes |
The project name. |
ali-test-project |
| Accept-Encoding |
string |
No |
The compression method for the response content. SDK users do not need to specify this parameter because the SDK automatically handles compression and decompression.
Valid values:
|
lz4 |
| body |
object |
No |
The request struct. |
|
| from |
integer |
Yes |
The start time of the query. This time refers to the log time specified when log data is written. The time range defined by the from and to request parameters follows the left-closed, right-open principle. The time range includes the start time but excludes the end time. If the values of from and to are the same, the time range is invalid and the function returns an error. The value is a UNIX timestamp representing the number of seconds that have elapsed since January 1, 1970, 00:00:00 UTC. |
1627268185 |
| to |
integer |
Yes |
The end time of the query. This time refers to the log time specified when log data is written. The time range defined by the from and to request parameters follows the left-closed, right-open principle. The time range includes the start time but excludes the end time. If the values of from and to are the same, the time range is invalid and the function returns an error. The value is a UNIX timestamp representing the number of seconds that have elapsed since January 1, 1970, 00:00:00 UTC. |
1627268185 |
| line |
integer |
No |
The maximum number of logs to return. This parameter is valid only when the query parameter is a query statement (not an analytic statement). Minimum value: 0. Maximum value: 100. Default value: 100. |
100 |
| offset |
integer |
No |
The row from which the query starts. This parameter is valid only when the query parameter is a query statement (not an analytic statement). The value starts from 0. Default value: 0. |
0 |
| reverse |
boolean |
No |
Specifies whether to return logs in reverse chronological order of log timestamps, accurate to the minute level. This parameter is valid only when the query parameter is a query statement (not an analytic statement).
To sort results in an analytic statement, use the ORDER BY syntax. If ORDER BY is set to asc (default), logs are returned in ascending order. If ORDER BY is set to desc, logs are returned in descending order. |
false |
| powerSql |
boolean |
No |
Specifies whether to enable Dedicated SQL. Disabled by default. |
false |
| session |
string |
No |
The query parameter. |
mode=scan |
| topic |
string |
No |
The topic. Default value: empty string. |
"" |
| query |
string |
No |
The query statement or analytic statement. For more information, see query overview and analysis overview. Add set session parallel_sql=true; to the analytic statement in the query parameter to use Dedicated SQL. Example: * | set session parallel_sql=true; select count(*) as pv. Note: When the query parameter contains an analytic statement (SQL statement), the line and offset parameters of this API are invalid. Set them to 0. Use the LIMIT syntax in the SQL statement for pagination. For more information, see Display query and analysis results by page. |
status: 401 | SELECT remote_addr,COUNT(*) as pv GROUP by remote_addr ORDER by pv desc limit 5 |
| forward |
boolean |
No |
Specifies whether to page forward or backward for scan or phrase queries. |
false |
| highlight |
boolean |
No |
Specifies whether to enable highlighting. |
false |
| isAccurate |
boolean |
No |
Specifies whether to enable nanosecond-precision ordering. |
true |
Response elements
|
Element |
Type |
Description |
Example |
|
object |
The response body. |
||
| meta |
object |
The metadata of the response. |
|
| progress |
string |
Indicates whether the query results are complete. Valid values:
|
Complete |
| aggQuery |
string |
The SQL part after the pipe (|) in the query statement. |
select * |
| whereQuery |
string |
The part before the pipe (|) in the query statement. |
* |
| hasSQL |
boolean |
Indicates whether the query is an SQL query. |
false |
| processedRows |
integer |
The number of rows processed in this query. |
10000 |
| elapsedMillisecond |
integer |
The time consumed by this query, in milliseconds. |
5 |
| cpuSec |
number |
The core-hour consumed by Dedicated SQL. |
0.002 |
| cpuCores |
integer |
The number of CPU cores used. |
3 |
| keys |
array |
All keys in the query results. |
|
|
string |
key |
key |
|
| terms |
array<object> |
All terms in the query statement. |
|
|
object |
The term. |
{term=*, key=} |
|
| limited |
integer |
The limit on the number of rows. Returned when the SQL statement does not contain a LIMIT clause. |
100 |
| mode |
integer |
The query mode. Valid values:
|
0 |
| phraseQueryInfo |
object |
The phrase query information. |
|
| scanAll |
boolean |
Indicates whether all logs have been scanned. |
true |
| beginOffset |
integer |
The start offset of the scan results after index filtering. |
0 |
| endOffset |
integer |
The end offset of the scan results after index filtering. |
0 |
| endTime |
integer |
The end time of the scan results after index filtering. |
1 |
| scanBytes |
integer |
The amount of data scanned during the scan, in bytes. |
1024 |
| highlights |
array<object> |
The highlighted content. |
|
|
object |
The highlighted content. |
||
| count |
integer |
The number of log entries returned in this query request. |
1 |
| processedBytes |
integer |
The volume of logs processed by the query, in bytes. |
10000 |
| isAccurate |
boolean |
Specifies whether to enable nanosecond-precision ordering. |
true |
| columnTypes |
array |
The column types. |
|
|
string |
The type. |
long |
|
| telementryType |
string |
The observable data type. |
None |
| data |
array<object> |
The returned results. |
|
|
object |
The returned data. |
||
|
string |
The returned data. |
{'remote_addr': '198.51.XXX.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'} |
Examples
Success response
JSON format
{
"meta": {
"progress": "Complete",
"aggQuery": "select *",
"whereQuery": "*",
"hasSQL": false,
"processedRows": 10000,
"elapsedMillisecond": 5,
"cpuSec": 0.002,
"cpuCores": 3,
"keys": [
"key"
],
"terms": [
{
"test": "test",
"test2": 1
}
],
"limited": 100,
"mode": 0,
"phraseQueryInfo": {
"scanAll": true,
"beginOffset": 0,
"endOffset": 0,
"endTime": 1
},
"scanBytes": 1024,
"highlights": [
{
"test": "test",
"test2": 1
}
],
"count": 1,
"processedBytes": 10000,
"isAccurate": true,
"columnTypes": [
"long"
],
"telementryType": "None"
},
"data": [
{
"key": "{'remote_addr': '198.51.XXX.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'}"
}
]
}Error codes
See Error Codes for a complete list.
Release notes
See Release Notes for a complete list.