Simple Log Service:Modify and delete log data

RowID

RowID is a logical record identifier that Simple Log Service assigns to each log entry written to a Logstore with row-level update and delete enabled. All modify and delete operations use RowID to locate the target record.

• Format: Simple Log Service generates the RowID at write time. You cannot customize or construct a RowID. Treat it as an opaque identifier.

• Stability: A RowID remains unchanged throughout the lifecycle of a log record. Even after you modify a record, the same RowID still points to that record.

• Visibility: Query results from a Logstore with this feature enabled automatically include the built-in field __rowid__. This is a reserved field name and cannot be used in index configurations.

AffectedRows

Each successful modify or delete request returns AffectedRows, which indicates the number of log records that the operation actually affected. Use this value to verify that the operation performed as expected.

Enable through OpenAPI

Call the CreateLogStore API and set enableModify to true in the request body:

POST /logstores HTTP/1.1
Host: <project>.<endpoint>
Content-Type: application/json

{
  "logstoreName": "my-logstore",
  "ttl": 30,
  "shardCount": 1,
  "enableModify": true
}

After you create the Logstore, call the GetLogStore API to verify. If the response body contains "enableModify": true, the feature is enabled.

Enable through the Python SDK

from aliyun.log import LogClient

# Obtain AccessKey credentials from environment variables.
client = LogClient(endpoint, access_key_id, access_key)

client.create_logstore(
    project_name="my-project",
    logstore_name="my-logstore",
    ttl=30,
    shard_count=1,
    enable_modify=True,
)

Method 1: Modify and delete by RowID

Use this method when you already have the RowID of a specific record, typically obtained from a previous query result.

from aliyun.log import LogClient, LogItem

client = LogClient(endpoint, access_key_id, access_key)

# Specify only the fields to update. Unspecified fields keep their original values.
new_item = LogItem(
    contents=[("status", "REFUNDED")],
)

resp = client.update_logs(
    project="my-project",
    logstore="my-logstore",
    rowid=rowid,
    log_item=new_item,
)
print(f"Affected rows: {resp.affected_rows}")

resp = client.delete_logs_v2(
    project="my-project",
    logstore="my-logstore",
    rowid=rowid,
)
print(f"Affected rows: {resp.affected_rows}")

Method 2: Modify and delete by query

Use this method to batch-modify or batch-delete records that match a query condition. Simple Log Service runs the query on the server side and applies the modification or deletion to all matching records.

resp = client.delete_logs_v2(
    project="my-project",
    logstore="my-logstore",
    from_time=1716537600,
    to_time=1716624000,
    query='level: DEBUG',
)
print(f"Deleted rows: {resp.affected_rows}")

resp = client.update_logs(
    project="my-project",
    logstore="my-logstore",
    from_time=1716537600,
    to_time=1716624000,
    query='order_id: 12345 and status: "PENDING"',
    update_fields={"status": "REFUNDED", "refund_at": "2026-05-25T10:00:00Z"},
)
print(f"Modified rows: {resp.affected_rows}")

Can I enable this feature for an existing Logstore?

No. This feature depends on an underlying storage format that is only available at Logstore creation time. To use this feature, create a new Logstore with enableModify=true, and migrate historical data to the new Logstore through data transformation or the SDK.

Do modify and delete operations affect real-time consumers?

No. LogHub consumers and delivery tasks (such as delivery to OSS or MaxCompute) operate on the original write stream and do not reflect modifications or deletions. Only query-based read paths (Search, SQL, and SPL) return the latest data.

Are modifications and deletions immediately visible?

Yes. After a request succeeds, new queries return the updated data. The AffectedRows value in the response indicates the number of records that were actually modified or deleted.

Can I roll back an accidental modification or deletion?

No. There is no built-in rollback mechanism. Before you run a modify or delete operation, use Search or SQL to preview the records that match your query condition. We recommend that you use dedicated RAM users with restricted permissions for these operations and enable ActionTrail for auditing.

Does deletion immediately free up storage space?

Deletion is a logical operation. The underlying storage is retained until the Logstore TTL (time to live) expires or a background compaction task runs. However, all query paths filter out deleted records, so deleted data is invisible to users.