Query raw data - Simple Log Service - Alibaba Cloud Documentation Center

The Raw Data page displays the logs that are actually ingested by your application. You can use this page to verify whether data is reported, check field content, and locate a request by searching logs. Both direct write and reference SessionStores are queried from their own Raw Data entry, and you do not need to manually switch to another storage destination.

Prerequisites

Data ingestion is complete, and you have permissions to query the destination data.
Data exists within the query time range.
If you use field-based search or SQL analysis, the related indexes are configured and available. In reference mode, the indexes are managed in the source Logstore.

Procedure

Open the destination SessionStore and select Raw Data.
Set the time range. The default time range for the first visit is the last 15 minutes. To troubleshoot historical issues, select the corresponding absolute time range.
Enter a query statement in the search box and click Search & Analyze.
View the fields and log content in the results. You can use the histogram, quick analysis, and column settings as needed.
If no results are returned, use * to try again, and then add filter conditions step by step.

Note: Raw data, trajectories, and sessions do not necessarily use the same field names. For example, some OpenTelemetry raw logs use traceId, whereas processed trajectories use trace_id. View the raw records first instead of copying field names from other pages.

Common query examples

The example values are for reference only. Replace them with your actual data.

View all logs within the time range

Query a trace by the actual raw field

The following example applies only when the raw logs contain and index traceId.

traceId:"0123456789abcdef0123456789abcdef"

If your raw logs use trace_id or another name, replace it with the actual field.

Combine multiple field conditions

The following example requires that serviceName and statusCode are searchable.

serviceName:"demo-toolservice" AND statusCode:"2"

Different collection solutions may define status codes differently. Do not interpret the number 2 as a specific business status before you verify the data format.

Count the logs within the current range

In query modes that support SQL, you can use the following statement:

* | SELECT count(*) AS log_count

This statement counts the matching raw log records, not the number of sessions, unique requests, or trajectories. If other fields are used in the analysis, the corresponding analytic indexes are required. The specific query capabilities depend on the current resource and service support.

Use query assistance features

Feature	Purpose
Histogram	Shows the distribution of logs within the time range to help you locate periods in which data exists or data exceptions are concentrated.
Quick analysis	Shows the distribution of available fields to help you select further search conditions.
Column settings	Adjusts the fields that are displayed in the log list to reduce irrelevant information.
Query and analysis properties	Shows the current indexes. The indexes of raw data in direct write mode can be created or modified based on your permissions. The indexes of the referenced source are read-only.

If a query returns an error, distinguish between a request failure and no matching data. A field that does not exist, an unsupported index, or insufficient permissions does not mean that the business behavior did not occur.

Limits

The Raw Data page of a SessionStore does not provide all console features of a standard Logstore. Entries for log download, contextual query, LiveTail, automatic refresh, saved searches, alert creation, and general sharing are not available. Do not look for these operations by following the menu paths of a standard Logstore.

If you need the latest data, run the query again. When you view historical issues, we recommend that you use an absolute time range to avoid missing the original data as the relative time moves forward.