SLS OSS log types and field reference - Simple Log Service

OSS log types

Log type	Description
Access log	You must manually enable this feature. For instructions, see Enable the log collection feature. Collects all access logs for the specified OSS bucket in real time, including records from batch deletion operations. Note The DeleteObjects operation generates a request record in the access log. The `oss-log-store` may contain both access logs and hourly metering logs (which are different from the metering logs described below). `_topic_:oss_access_log` represents access logs, and `_topic_:oss_metering_log` represents hourly metering logs.
Metering log	Enabled by default for free. Records hourly aggregated metering data for a specific OSS bucket. The logs are generated after a delay of several hours.
Monitoring metrics	Enabled by default for free. Records metrics at two granularities: requests, latency, and traffic every 10 seconds, and requests and traffic every 5 minutes.

OSS built-in logs vs. SLS access logs

SLS records, collects, stores, and analyzes OSS access logs, batch deletion logs, and hourly metering logs in real time. OSS built-in logging records and stores access logs at the bucket level.

SLS logs include all information from OSS built-in logs, but the log fields differ. The following table shows the mapping. For more information, see Access logs.

OSS built-in log field	SLS-OSS log field
Remote IP	client_ip
Time	time
Request-URI	request-uri
HTTP Status	http_status
SentBytes	response_body_length
RequestTime (ms)	response_time
Referer	referer
User-Agent	user-agent
HostName	host
Request ID	request_id
LoggingFlag	logging_flag
Requester Aliyun ID	requester_id
Operation	operation
Bucket	bucket
Key	object
ObjectSize	object_size
Server Cost Time (ms)	server_cost_time
Error Code	error_code
Request Length	request_length
UserID	owner_id
Delta DataSize	delta_data_size
Sync Request	sync_request

Access logs

Field	Description
__topic__	The log topic. The value is always oss_access_log.
time	The time when the OSS request completed. Example: 27/Feb/2018:13:58:45. If you need a timestamp, use the __time__ field.
access_id	The AccessKey ID of the requester.
owner_id	The Alibaba Cloud account ID of the OSS bucket owner.
user_agent	The User-Agent header of the HTTP request. Example: curl/7.15.5.
logging_flag	Indicates whether logs are periodically exported to an OSS bucket. If true, this feature is enabled.
bucket	The name of the OSS bucket.
content_length_in	The value of the Content-Length request header. Unit: bytes.
content_length_out	The value of the Content-Length response header. Unit: bytes.
object	The requested OSS object. The object name is URL-encoded. To decode the object name, run `select url_decode(object)`.
object_size	The size of the OSS object. Unit: bytes.
operation	The API operation. For more information, see Appendix: API operations.
bucket_location	The region of the OSS bucket. The format is typically `oss-<region ID>`.
request_uri	The URI of the HTTP request, including the query string. The URI is URL-encoded. To decode the URI, run `select url_decode(request_uri)`.
error_code	The error code returned by OSS. For more information, see OSS error codes.
request_length	The size of the HTTP request, including the header. Unit: bytes.
client_ip	The source IP address of the request. This can be the IP address of the client, its network firewall, or a proxy.
response_body_length	The size of the HTTP response body. Unit: bytes.
http_method	The HTTP request method.
referer	The request's HTTP referer.
requester_id	The ID of the requester. If the request is anonymous, the value is a hyphen (-).
request_id	The request ID.
response_time	The HTTP response time. Unit: milliseconds.
server_cost_time	The server-side processing time for the request. Unit: milliseconds.
http_type	The request protocol. Valid values: HTTP and HTTPS.
sign_type	The signature type. NotSign: The request is not signed. NormalSign: The request is signed using a standard method. UriSign: The request is signed using a pre-signed URL. AdminSign: The request is signed using an administrator account. NORMAL_SIGN4: V4 signature. URI_SIGN4: V4 signature included in a URL.
http_status	The HTTP status code of the response.
sync_request	The request type. A hyphen (-): Indicates a standard request. cdn: Indicates a back-to-origin request. lifecycle: Indicates a request triggered by a lifecycle rule.
bucket_storage_type	The storage class of the OSS object. standard: Standard archive: Archive IA: Infrequent Access (IA)
host	The endpoint used for the request. Example: bucket123.oss-cn-beijing.aliyuncs.com.
vpc_addr	The high-availability virtual IP (HAVIP) address of the OSS VPC. This address is an integer, for example, 343819108. Use `int_to_ip(cast(vpc_addr as bigint))` to convert the integer to an IP address, and then reverse the order of the resulting octets. For example, a conversion result of `9.58.XXX.XXX` becomes `XXX.XXX.58.9` after reversal.
vpc_id	The ID of the OSS VPC.
delta_data_size	The change in object size, in bytes. This field is 0 if the size does not change, or a hyphen (-) for non-upload requests.
ec	The detailed error code. To troubleshoot issues based on the error code, see Troubleshoot issues based on ECs.
acc_access_region	If the request uses transfer acceleration, this field indicates the region of the acceleration endpoint. Otherwise, the value is a hyphen (-).
restore_priority	The restoration priority.
extend_information	Contains extended information. The default value is a hyphen (-). For requests made with a RAM role, this field contains role information as a comma-separated string: `requesterParentId,roleName,roleSessionName,roleOwnerId`. New fields may be added in the future.
user_defined_log_fields	Contains user-defined log data. The default value is a hyphen (-). If custom headers and parameters are configured for the bucket, this field contains information about them as a Base64-encoded JSON string.
archive_direct_read_size	The billed data size for an Archive direct read request, in bytes. This field is a hyphen (-) for other request types.

Batch delete logs

Calling the DeleteObjects operation generates a request record in the access log. However, because the HTTP request body stores information about the deleted files, the value of the object field in the access log is a hyphen (-). To view the list of deleted files, check the batch delete log. The following table describes the fields of a batch delete log. You can correlate the batch delete log with the access log by using the request_id field.

Parameter	Description
__topic__	The log topic. The value is fixed to oss_batch_delete_log.
bucket	The name of the OSS bucket.
bucket_location	The data center that hosts the OSS bucket. The format is oss-<region ID>.
client_ip	The source IP address of the request, which can be the IP address of the client, its network firewall, or a proxy.
delta_data_size	The change in the size of the OSS object. The value is 0 if the size does not change. If the request is not an upload request, the value is a hyphen (-).
error_code	The error code returned by OSS. For more information, see OSS error codes.
host	The endpoint used for the request, for example, bucket123.oss-cn-beijing.aliyuncs.com.
http_method	The HTTP request method, for example, POST.
http_status	The HTTP status returned for the request.
logging_flag	Indicates whether logs are periodically exported to an OSS bucket. A value of true indicates this feature is enabled.
object	The requested OSS object. The object name is URL-encoded. To decode the name in a query, you can run `select url_decode(object)`.
object_size	The size of the requested OSS object, in bytes.
operation	The type of operation. For more information, see Log fields.
owner_id	The Alibaba Cloud account ID of the OSS bucket owner.
response_body_length	The size of the HTTP response body, excluding the header.
request_length	The size of the HTTP request, including the header, in bytes.
referer	The HTTP Referer of the request.
request_id	The request ID.
requester_id	The ID of the requester. If the request is anonymous, the value is a hyphen (-).
request_uri	The URI of the request, including the query string. The URI is URL-encoded. To decode the URI in a query, you can run `select url_decode(request_uri)`.
sync_request	The synchronization request type. A hyphen (-): Standard request. cdn: Back-to-origin request from a CDN. lifecycle: Request triggered by a lifecycle rule.
server_cost_time	The server-side request processing time, in milliseconds.
user_agent	The User-Agent header of the HTTP request, for example, curl/7.15.5.

Hourly metering logs

Hourly metering logs record per-bucket statistics on an hourly basis.

Parameter	Description
__topic__	The log topic. The value is fixed to oss_metering_log.
owner_id	The Alibaba Cloud account ID of the OSS bucket owner.
bucket	The name of the OSS bucket.
cdn_in	Inbound traffic from CDN. Unit: bytes.
cdn_out	Outbound traffic to CDN. Unit: bytes.
metering_datasize	The metered data size for storage classes other than Standard. Unit: bytes.
get_request	The number of GET requests.
intranet_in	Internal network inbound traffic. Unit: bytes.
intranet_out	Internal network outbound traffic. Unit: bytes.
network_in	Internet inbound traffic. Unit: bytes.
network_out	Internet outbound traffic. Unit: bytes.
put_request	The number of PUT requests.
storage	The storage usage of the OSS bucket. Unit: bytes.
storage_type	The storage class of the OSS bucket. standard: Standard archive: Archive IA: Infrequent Access
process_img_size	The total size of processed images. Unit: bytes.
sync_in	Inbound traffic from data replication. Unit: bytes.
sync_out	Outbound traffic for data replication. Unit: bytes.
start_time	The start timestamp of the metering period. Unit: seconds.
end_time	The end timestamp of the metering period. Unit: seconds.
region	The region where the OSS bucket is located.
process_img	The number of image processing operations.
bucket_location	The data center where the OSS bucket is located. The format is typically oss-<region ID>.
standard_total	Standard: Total physical capacity. Unit: bytes.
standard_lrs	Standard: Physical capacity for locally redundant storage. Unit: bytes.
standard_zrs	Standard: Physical capacity for zone-redundant storage. Unit: bytes.
ia_total	Infrequent Access: Total physical capacity. Unit: bytes.
ia_lrs	Infrequent Access: Physical capacity for locally redundant storage. Unit: bytes.
ia_zrs	Infrequent Access: Physical capacity for zone-redundant storage. Unit: bytes.
ia_total_charged_datasize	Infrequent Access: Total billable capacity. Unit: bytes.
ia_lrs_charged_datasize	Infrequent Access: Billable capacity for locally redundant storage. Unit: bytes.
ia_zrs_charged_datasize	Infrequent Access: Billable capacity for zone-redundant storage. Unit: bytes.
archive_total	Archive: Total physical capacity. Unit: bytes.
archive_lrs	Archive: Physical capacity for locally redundant storage. Unit: bytes.
archive_zrs	Archive: Physical capacity for zone-redundant storage. Unit: bytes.
archive_total_charged_datasize	Archive: Total billable capacity. Unit: bytes.
archive_lrs_charged_datasize	Archive: Billable capacity for locally redundant storage. Unit: bytes.
archive_zrs_charged_datasize	Archive: Billable capacity for zone-redundant storage. Unit: bytes.
coldarchive_total	Cold Archive: Total physical capacity. Unit: bytes.
coldarchive_lrs	Cold Archive: Physical capacity for locally redundant storage. Unit: bytes.
coldarchive_total_charged_datasize	Cold Archive: Total billable capacity. Unit: bytes.
coldarchive_lrs_charged_datasize	Cold Archive: Billable capacity for locally redundant storage. Unit: bytes.
deepcoldarchive_total	Deep Cold Archive: Total physical capacity. Unit: bytes.
deepcoldarchive_lrs	Deep Cold Archive: Physical capacity for locally redundant storage. Unit: bytes.
deepcoldarchive_total_charged_datasize	Deep Cold Archive: Total billable capacity. Unit: bytes.
deepcoldarchive_lrs_charged_datasize	Deep Cold Archive: Billable capacity for locally redundant storage. Unit: bytes.
reserved_capacity	The total used reserved capacity. Unit: bytes.
reserved_capacity_lrs	The used reserved capacity for locally redundant storage. Unit: bytes.
reserved_capacity_zrs	The used reserved capacity for zone-redundant storage. Unit: bytes.
total_storage	The total physical capacity across all storage classes. Unit: bytes.
total_storage_charged_datasize	The total billable capacity for all storage classes except Standard. Unit: bytes.
object_count	The number of objects. Unit: count.
standard_object_count_total	Standard: Total object count. Unit: count.
standard_object_count_lrs	Standard: Object count for locally redundant storage. Unit: count.
standard_object_count_zrs	Standard: Object count for zone-redundant storage. Unit: count.
ia_object_count_total	Infrequent Access: Total object count. Unit: count.
ia_object_count_lrs	Infrequent Access: Object count for locally redundant storage. Unit: count.
ia_object_count_zrs	Infrequent Access: Object count for zone-redundant storage. Unit: count.
archive_object_count_total	Archive: Total object count. Unit: count.
archive_object_count_lrs	Archive: Object count for locally redundant storage. Unit: count.
archive_object_count_zrs	Archive: Object count for zone-redundant storage. Unit: count.
coldarchive_object_count_total	Cold Archive: Total object count. Unit: count.
coldarchive_object_count_lrs	Cold Archive: Object count for locally redundant storage. Unit: count.
deepcoldarchive_object_count_total	Deep Cold Archive: Total object count. Unit: count.
deepcoldarchive_object_count_lrs	Deep Cold Archive: Object count for locally redundant storage. Unit: count.

Appendix: API operations

The following table lists the API operations. For more information, see API overview.

Actions	Description
AbortMultiPartUpload	Aborts a multipart upload.
AppendObject	Appends data to an object.
CompleteUploadPart	Completes a multipart upload.
CopyObject	Copies an object.
DeleteBucket	Deletes a bucket.
DeleteLiveChannel	Deletes a LiveChannel.
DeleteObject	Deletes an object.
DeleteObjects	Deletes multiple objects.
ExpireObject	Deletes an expired object.
GetBucket	Lists all objects in a bucket.
GetBucketAcl	Retrieves the access control list (ACL) for a bucket.
GetBucketCors	Retrieves the cross-origin resource sharing (CORS) configuration for a bucket.
GetBucketEventNotification	Retrieves the notification configuration for a bucket.
GetBucketInfo	Retrieves information about a bucket.
GetBucketLifecycle	Retrieves the lifecycle configuration for a bucket.
GetBucketLocation	Returns the region of a bucket.
GetBucketLog	Retrieves the access log configuration for a bucket.
GetBucketReferer	Retrieves the hotlink protection configuration for a bucket.
GetBucketReplication	Retrieves the cross-region replication configuration for a bucket.
GetBucketReplicationProgress	Retrieves the replication progress for a cross-region replication rule.
GetBucketStat	Returns storage statistics for a bucket.
GetBucketWebSite	Retrieves the static website hosting configuration for a bucket.
get_image_exif	Retrieves the EXIF data of an image object.
get_image_info	Retrieves information about an image object, such as its height and width.
get_image_infoexif	Retrieves the height, width, and EXIF data of an image object.
GetLiveChannelStat	Returns the status of a LiveChannel.
GetObject	Retrieves an object.
GetObjectAcl	Retrieves the access control list (ACL) for an object.
GetObjectInfo	Retrieves information about an object.
GetObjectMeta	Retrieves the metadata from an object without returning its content.
GetObjectSymlink	Returns the target of a symbolic link.
GetPartData	Retrieves data from a part of a multipart upload.
GetPartInfo	Retrieves information about a part in a multipart upload.
GetProcessConfiguration	Retrieves the image processing configuration for a bucket.
GetService	Lists all buckets owned by the authenticated sender of the request.
get_style	Retrieves a style for a bucket.
HeadBucket	Checks if a bucket exists and you have permission to access it.
HeadObject	Retrieves metadata from an object without returning its content.
InitiateMultipartUpload	Initiates a multipart upload and returns an upload ID.
ListMultiPartUploads	Lists all in-progress multipart uploads in a bucket.
ListParts	Lists the parts that have been uploaded for a specific multipart upload.
list_style	Lists all styles for a bucket.
PostObject	Uploads an object using an HTML form.
PostProcessTask	Submits a data processing task, such as creating a snapshot.
PostVodPlaylist	Creates a video-on-demand (VOD) playlist for a LiveChannel.
ProcessImage	Processes an image object.
PutBucket	Creates a new bucket.
PutBucketCors	Sets the cross-origin resource sharing (CORS) configuration for a bucket.
PutBucketLifecycle	Sets the lifecycle configuration for a bucket.
PutBucketLog	Sets the access log configuration for a bucket.
PutBucketWebSite	Sets the static website hosting configuration for a bucket.
PutLiveChannel	Creates a LiveChannel.
PutLiveChannelStatus	Sets the status of a LiveChannel.
PutObject	Uploads an object to a bucket.
PutObjectAcl	Sets the access control list (ACL) for an object.
PutObjectSymlink	Creates a symbolic link that targets another object.
put_style	Creates or modifies a style for a bucket.
RedirectBucket	Configures a bucket to redirect all requests to another host.
RestoreObject	Restores an archived object.
UploadPart	Uploads a part in a multipart upload.
UploadPartCopy	Uploads a part by copying data from an existing object.