Simple Log Service:Query and analysis

Item

Description

Number of keywords

The number of keywords that are used as search conditions. The number of logical operators is not included. You can specify up to 30 keywords in a search statement.

Size of a field value

The maximum size of a field value is 512 KB. The excess part is not involved in searching.

If the size of a field value is greater than 512 KB, logs may fail to be obtained by using keywords, but the logs are actually stored in the Logstore.

Maximum number of concurrent search statements

Each project supports up to 100 concurrent search statements.

For example, 100 users can concurrently execute search statements in all Logstores of a project.

Returned result

The returned logs are displayed on multiple pages. Each page displays up to 100 logs.

Fuzzy search

In a fuzzy search, Simple Log Service matches up to 100 words that meet the specified conditions and returns the logs that meet the search conditions and contain one or more of these words. For more information, see Fuzzy search.

Data sorting in search results

By default, search results are displayed in descending order of the time, which is accurate to the second. If the search results are returned within nanoseconds, the search results are displayed in descending order of the time, which is accurate to the nanosecond.

Limit

Standard instance

Dedicated SQL instance

SQL enhancement

Complete accuracy

Concurrency

Up to 15 concurrent queries per project.

Up to 100 concurrent queries per project.

Up to 5 concurrent queries per project.

Data volume

A single query can scan up to 400 MB of log data (excluding cached data). Data exceeding this limit is truncated and marked as incomplete query results.

A single query can scan up to 2 GB of log data (excluding cached data). Data exceeding this limit is truncated and marked as incomplete query results.

Unlimited.

Method to enable

By default, the log analysis feature is enabled.

A switch is provided for you to manually enable Dedicated SQL.

A switch is provided for you to manually enable Dedicated SQL.

Fee

Free of charge.

You are charged based on the actual CPU time.

You are charged based on the actual CPU time.

Data effectiveness mechanism

Return results

Maximum field length

Timeout period

Number of bits for double-type field values

Item

Description

Remarks

Endpoints

The /query, /query_range, /labels, /label/{label}/values, and /series API endpoints are supported.

• For more information about HTTP API endpoint-based access, see Details of Metricstore-related HTTP API.

• For more information about the PromQL syntax that is supported in SQL, see Query and analysis syntax on metric data.

Data specifications

1. A metric name must match the [a-zA-Z_:][a-zA-Z0-9_:]* regular expression.

2. A label key must match the [a-zA-Z_][a-zA-Z0-9_]* regular expression. A label value cannot contain vertical bars (|).

For more information, see Metric.

Maximum number of concurrent search statements

Each project supports up to 15 concurrent search statements.

For example, 15 users can concurrently execute search statements in all Metricstores of a project.

Maximum amount of read data

You can read up to 200 million time series, 200 million data points, or 200 MB of data from a shard at a time. If one of the preceding limits is reached when you read data from a shard, data read stops.

The status indicating that only partial data of the shard is read is returned. In this case, we recommend that you split sufficient shards from which you can read a large amount of data.

Maximum amount of data on the computing side

Before you perform PromQL calculation, the system checks the amount of raw data in a node. Up to 200 million time series, 200 million data points, or 2 GB of data can be involved in the calculation. If one of the preceding limits is reached, an error is returned.

If your business is strongly dependent on large-scale data aggregation in a single operation, we recommend that you enable the concurrent computing feature. For more information, see Concurrent computing.

Maximum number of data points on the computing side

In the PromQL-Engine calculation process, if the number of data points selected and included in the calculation exceeds 50 million, an error is returned.

The computing limits imposed on open source Prometheus are also imposed on PromQL-Engine. If aggregate calculation is involved in a query, we recommend that you use the concurrent computing feature.

Results of PromQL statements

In standard open source protocols, the /query_range endpoint supports up to 11,000 data points returned for a time series. If the value of the query parameter matches the (end - start)/step > 11000 expression, an error is returned.

If you want to query data over a long period of time, we recommend that you specify a larger value for the step parameter.

Results of SQL statements

By default, up to 100 data entries can be returned for an SQL query operation or calculation. If you add the LIMIT ALL clause to an SQL statement, up to 1 million data entries can be returned. This limit takes effect in the following scenarios:

1. Use SQL statements to perform calculation on raw time series data.

2. Use nested PromQL subqueries in SQL statements to perform calculation.

One million data entries represent one million data points. For more information about the search syntax, see Query and analysis syntax on metric data.

Nested PromQL subqueries in SQL statements

The length of a PromQL statement cannot exceed 3,000 characters.

For more information about the search syntax, see Query and analysis syntax on metric data.

lookback-delta

By default, this parameter is set to 3 minutes in Simple Log Service Metricstores.

lookback-delta is a PromQL query-specific parameter. For more information, see lookback-delta.

You can specify a custom PromQL API operation to configure this parameter. The maximum value is 3 days. For more information, see API operations for metric queries.

Timeout period

The default value is 1 minute for PromQL API operation-based queries and 55 seconds for SQL queries.

You can specify a custom PromQL API operation to configure this parameter. For more information, see API operations for metric queries.

Meta class endpoints

For query performance purposes, you can use endpoints of the meta class to query data that are generated within 5 minutes. This limit is valid for the /labels, /label/{label}/values, and /series endpoints.

The time window of 5 minutes includes the start time, which is 5 minutes before the end time, and the end time specified by the end parameter. The time window of 5 minutes is [end - 5min, end].

You can specify a custom PromQL API operation to specify the start time and end time of metadata. For more information, see Query Series API operation.