When you need to query a log field that has no index—or when the indexed value is truncated—scan-based query lets you search raw log data directly, with no index setup required.
How it works
Simple Log Service supports two query modes:
Index-based query: Queries run against pre-built field indexes. Fast and cost-efficient for fields you query regularly.
Scan-based query: Queries scan raw log data directly at query time. No index required—the scan reads the actual log content.
The two modes are complementary. Use index-based queries for high-frequency fields where speed matters, and scan-based queries for fields where indexing is impractical or not worth the cost.
Low costs: No indexes are required, and you are not charged for index traffic or index storage.
Flexible implementation: You can specify field types based on your business requirements regardless of whether indexes are created or index types are specified.
Optimized search capability: More functions are supported compared to index-based query.
When to use scan-based query
Scan-based query addresses scenarios that index-based query cannot handle:
Querying un-indexed historical logs. If you skipped indexing a field to reduce costs, you can still query it on demand with scan—without rebuilding the index.
Field values that exceed the index length limit. Indexes only cover values up to the supported length; anything beyond is invisible to index-based query. Scan reads the full value.
Dynamic or unpredictable field names. When field names are unknown in advance, you cannot create indexes ahead of time. Scan lets you query any field at query time without prior configuration.
Field type changes. After a field type changes, the existing index may not match the new type. Scan bypasses the index and reads the raw data directly.
For more information about the scan-based analysis feature, see Syntax of scan-based analysis.
Index-based query vs. scan-based query
|
Dimension |
Index-based query |
Scan-based query |
|
Field setup |
Field index required |
No index required |
|
Query speed |
Fast (uses pre-built index structures) |
Slower (scans raw log data at query time) |
|
Cost |
Index traffic and storage fees apply |
No index traffic or storage fees |
|
Best for |
High-frequency queries on known fields |
Ad hoc queries, un-indexed fields, dynamic schemas |
|
Field value length |
Limited by index length |
Reads full value regardless of length |
|
Field type flexibility |
Constrained by index type |
Reads raw data, not index type |