Use the CLI to query logs with get_log_all - Simple Log Service

You can use the command-line interface (CLI) to query logs. This command is ideal for retrieving large amounts of log data.

Request syntax

aliyunlog log get_log_all --project=<value> --logstore=<value> --from_time=<value> --to_time=<value> [--topic=<value>] [--query=<value>] [--reverse=<value>] [--offset=<value>] [--access-id=<value>] [--access-key=<value>] [--sts-token=<value>] [--region-endpoint=<value>] [--client-name=<value>] [--jmes-filter=<value>] [--format-output=<value>] [--decode-output=<value>]

Request parameters

The following table describes the required and unique parameters for this command.

Parameter name	Numeric type	Required	Example	Description
--project	String	Yes	aliyun-test-project	The name of the project.
--logstore	String	Yes	logstore-a	The name of the Logstore.
--from_time	String	Yes	2025-06-01 00:00:00+8:00	The start of the time range to query. Specify the value as a UNIX timestamp or in the `“%Y-%m-%d %H:%M:%S<time_zone>”` format. Example: `”2025-06-01 00:00:00+8:00”`.
--to_time	String	Yes	2025-06-01 01:00:00+8:00	The end of the time range to query. Specify the value as a UNIX timestamp or in the `“%Y-%m-%d %H:%M:%S<time_zone>”` format. Example: `”2025-06-01 01:00:00+8:00”`.
--topic	String	No	""	The topic of the logs. For more information, see Topic.
--query	String	No	`level:Information\|select event_id as Key1,COUNT(*) as Key2 group by Key1`	The query and analysis statement. For more information, see Query overview and Query and analysis overview. Note If the query parameter contains an analytic statement (SQL statement), set the line and offset parameters to 0 and use the LIMIT clause for paging. For more information, see Paginate query and analysis results.
--reverse	Boolean	No	true	Specifies whether to return logs in reverse chronological order based on the log timestamp. The timestamp is accurate to the minute. true: Returns logs in reverse chronological order. The latest logs are returned first. false (default): Returns logs in chronological order.
--offset	Integer	No	0	The row from which to start reading the query results. Default value: 0.

For more information about the global parameters for this command, see Global parameters.

Examples

Request example
Use the default account to query the number of events where the request method is POST. The following is a sample command:
```
aliyunlog log get_log_all --project="aliyun-test-project" --logstore="logstore-a" --from_time="2025-06-01 00:00:00+8:00" --to_time="2025-06-01 01:00:00+8:00"  --query="request_method:POST|select status,COUNT(*) as pv group by status" --format-output=json
```
Note
Replace from_time and to_time with a time range that contains log data in your Logstore. Queries on time ranges without data return empty results.

Response example

{
  "data": [],
  "meta": {
    "aggQuery": "select status,COUNT(*) as pv group by status",
    "columnTypes": [
      "long",
      "long"
    ],
    "count": 0,
    "cpuCores": 11,
    "cpuSec": 0.019,
    "elapsedMillisecond": 21,
    "hasSQL": true,
    "insertedSQL": "1,29, from \"logstore-a\" ",
    "isAccurate": true,
    "keys": [
      "status",
      "pv"
    ],
    "limited": 100,
    "powerSql": false,
    "processedBytes": 0,
    "processedRows": 0,
    "progress": "Complete",
    "telementryType": "logging",
    "telemetryType": "logging",
    "terms": [
      {
        "key": "",
        "term": "request_method\uff1apost"
      }
    ],
    "whereQuery": "request_method\uff1aPOST"
  }
}

Download example

Use the get_log_all command to download logs to a local file. The following is a sample command:

aliyunlog log get_log_all --project="aliyun-test-project" --logstore="logstore-a" --from_time="2025-06-01 00:00:00+8:00" --to_time="2025-06-01 01:00:00+8:00" --query="status:200|select request_method as method,COUNT(*) as pv group by method order by pv" --format-output=json >>download_data.txt

Download description

After the command runs successfully, a file named download_data.txt is created in the root directory where you ran the command. You can view the log information in this file.

{
  "data": [],
  "meta": {
    "aggQuery": "select status,COUNT(*) as pv group by status",
    "columnTypes": [
      "long",
      "long"
    ],
    "count": 0,
    "cpuSec": 0.019,
    "elapsedMillisecond": 0,
    "hasSQL": true,
    "insertedSQL": "1,29, from \"gs-api\" ",
    "isAccurate": true,
    "keys": [
      "status",
      "pv"
    ],
    "limited": 100,
    "processedBytes": 0,
    "processedRows": 0,
    "progress": "Complete",
    "telementryType": "logging",
    "telemetryType": "logging",
    "terms": [
      {
        "key": "",
        "term": "request_method\uff1apost"
      }
    ],
    "whereQuery": "request_method\uff1aPOST"
  }
}

More information

Command	Scenarios
get_logs	Use a JSON configuration file to perform a term query on log data.
get_log	Query a specified number of logs.