Query and analyze logs using an index pattern - Simple Log Service

Before you begin

Simple Log Service provides log query and analysis features. Get started with log query and analysis.
Collect logs into a Standard logstore (Manage a logstore). After you create an index, queries and analysis apply only to incremental logs. To query historical log files, reindex them.
To query tens of billions of logs, see What do I do if the "The results are inaccurate" error message appears in the console?.
Simple Log Service includes reserved fields by default. Reserved fields describes how to analyze them.

Query and analysis

Simple Log Service allows you to query billions of logs in seconds and analyze results using SQL. A search statement can run alone, but an analytic statement must follow a search statement to analyze query results or the full dataset.

Note

SLS Query Skill for intelligent log query and analysis: Simple Log Service provides an Agent Skill for querying and analyzing SLS log data with natural language in a local AI Agent.

Basic syntax

A query consists of a search statement and an optional analytic statement, separated by a pipe (|). A search statement can run alone, but an analytic statement must follow a search statement.

Search statement | Analytic statement

Type	Description
Search statement	A search statement specifies filtering rules and returns matching logs. The query format is `Search statement`, for example: `status: 200`. Search conditions include keywords, numbers, numeric ranges, spaces, and asterisks (``). A space or asterisk (``) matches all logs. Query syntax and features. Important Use no more than 30 conditions in a search statement.
Analytic statement	To use analytics, collect logs into a Standard logstore and enable Enable Analytics for the required fields when configuring the index. An analytic statement computes and analyzes query results or the full dataset. Supported functions and syntax: SQL functions: SQL functions are typically used to compute, transform, and format data — sums, averages, string operations, and date processing. SQL clauses: SQL clauses build complete query or data manipulation statements. They define the data source, conditions, grouping, sorting, and more. Nested subqueries: A nested subquery is a SELECT statement nested inside another SELECT for complex analysis. Federated query and analysis of Logstore and MySQL data: Perform federated queries across Logstore and MySQL data using `JOIN` syntax and save results to MySQL. Use SPL to query and analyze logs: Use SLS Processing Language (SPL) to extract structured information, manipulate fields, and filter log data. Important By default, an analytic statement analyzes data in the current logstore. `FROM` and `WHERE` clauses are not required. Analytic statements are case-insensitive, do not support the `offset` parameter, and do not require a trailing semicolon.

Simple Log Service provides ANTLR grammar files for developing custom applications based on SLS queries.

ANTLR grammar files:

Example

* | SELECT status, count(*) AS PV GROUP BY status

In the Statistical Chart tab, the query and analysis results are displayed as a line chart showing the PV distribution of HTTP status codes (499, 200, 301, 302, 304, 400). The General Configuration panel on the right allows you to switch chart types and configure the x-axis and y-axis fields.

Advanced features

LiveTail: Monitor logs in real time to reduce O&M workloads.
LogReduce: Extract patterns from similar logs during collection for a quick overview of log data.
Contextual query: View log context for troubleshooting.
Field analysis: View field distribution, statistical metrics, and top-five time series charts.
Event configuration: Configure events to extract details from raw logs.
StoreView overview: Use StoreView to perform cross-region and cross-store federated queries.

Query limits

Item	Description
Number of keywords	Up to 30 conditions per query, excluding logical operators.
Field value size	Maximum single field value size: 512 KB. Content beyond this limit is not indexed. Logs with field values exceeding 512 KB may not appear in keyword searches, but the log data remains intact. Note To configure the maximum field value length, see Why are field values truncated during query and analysis?
Concurrent operations	A single project supports up to 100 concurrent queries. For example, 100 users can query different logstores in the same project simultaneously.
Returned results	Up to 100 results per page. Navigate pages to view all results.
Fuzzy search	During a fuzzy search, Simple Log Service matches up to 100 terms and returns logs containing those terms that meet the search criteria. Fuzzy search.
Result sorting	Results are sorted by time in descending order, accurate to the second or nanosecond.

Limits

Limit	General-purpose instance	Dedicated SQL
Limit	General-purpose instance	SQL enhancement	Full Precision
Concurrency	Up to 15 concurrent queries per project.	Up to 100 concurrent queries per project.	Up to 5 concurrent queries per project.
Data volume	Up to 400 MB per query (excluding cached data). Excess data is truncated with an incomplete query result marker.	Up to 2 GB per query (excluding cached data). Excess data is truncated with an incomplete query result marker.	Unlimited.
Enabling the mode	Enabled by default.	Enable via toggle. SQL enhancement.	Enable via toggle. SQL complete accuracy.
Fee	Free of charge.	Charged based on the actual CPU time used.	Charged based on the actual CPU time used.
Data effectiveness	Applies only to data written after the feature is enabled. To analyze historical data, you must reindex the data.	Applies only to data written after the feature is enabled. To analyze historical data, you must reindex the data.	Applies only to data written after the feature is enabled. To analyze historical data, you must reindex the data.
Return results	By default, a query returns up to 100 rows and 100 MB. Queries exceeding 100 MB return an error. To return more data, use the LIMIT clause.	By default, a query returns up to 100 rows and 100 MB. Queries exceeding 100 MB return an error. To return more data, use the LIMIT clause.	By default, a query returns up to 100 rows and 100 MB. Queries exceeding 100 MB return an error. To return more data, use the LIMIT clause.
Field value size	Default maximum field value length is 2 KB (2,048 bytes), configurable up to 16 KB (16,384 bytes). Content exceeding the limit is excluded from analysis and retrieval. Note To change the limit, set Maximum Length of Text Field. The updated setting applies only to incremental data. Create an index.	Default maximum field value length is 2 KB (2,048 bytes), configurable up to 16 KB (16,384 bytes). Content exceeding the limit is excluded from analysis and retrieval. Note To change the limit, set Maximum Length of Text Field. The updated setting applies only to incremental data. Create an index.	Default maximum field value length is 2 KB (2,048 bytes), configurable up to 16 KB (16,384 bytes). Content exceeding the limit is excluded from analysis and retrieval. Note To change the limit, set Maximum Length of Text Field. The updated setting applies only to incremental data. Create an index.
Timeout period	Maximum timeout: 55 seconds.	Maximum timeout: 55 seconds.	Maximum timeout: 55 seconds.
Number of bits for double-typed field values	Maximum 52 bits for double-typed field values. Floating-point numbers encoded with more than 52 bits lose precision.	Maximum 52 bits for double-typed field values. Floating-point numbers encoded with more than 52 bits lose precision.	Maximum 52 bits for double-typed field values. Floating-point numbers encoded with more than 52 bits lose precision.

Simple Log Service:Index-based query and analysis