This topic provides answers to some frequently asked questions about global operations on alerts.
How do I use custom query statements to analyze alert logs?
Simple Log Service records the lifecycle of each alert as a log and stores the log in a dedicated Logstore. The Logstore is provided free of charge. You can use custom query statements to analyze alert logs in the Logstore. For more information, see Use custom query statements to analyze alert logs.
Alert logs can be retained for only 30 days. What do I do if I want to retain alert logs for more than 30 days?
Alert logs are stored in a Logstore named internal-alert-center-log. The Logstore is provided free of charge. Alert logs are retained for 30 days in the Logstore. The retention period cannot be changed.
If you want to retain alert logs for more than 30 days, you can use the data transformation feature to copy the logs to a different Logstore and specify a longer retention period. You are charged for this Logstore. For more information, see Replicate data from a Logstore.