All Products
Search

This Product

    Simple Log Service:Query and analysis quick start

    Document Center

    Simple Log Service:Query and analysis quick start

    Last Updated:Jul 03, 2026

    Simple Log Service queries billions of log entries in seconds and supports SQL-based analytics. This guide uses Nginx logs to show how to configure indexes and run basic queries.

    Prerequisites

    You have created a project and a standard Logstore with data collection configured. Manage Projects, Create a Logstore, Data collection overview.

    Step 1: Configure indexes

    1. Log on to the Simple Log Service console.

    2. In the Projects section, click the project you want.

    3. On the Log Storage > Logstores tab, click the logstore you want.

    4. On the Query & Analysis page of the Logstore, click Enable Index.

      Note

      Data becomes queryable about one minute after indexing is enabled.

      image

    5. Clicking Enable Index enables the full-text index by default. On the Query and Analysis page, click Automatic Index Generation to auto-generate field indexes from the first log entry in the data preview.

      Note

      Leave other parameters at their default values. Create indexes.

      image

      Generated field index configuration:

      image

    Step 2: Query and analyze logs

    Note

    In the search box on the Search & Analyze page, enter a search or analytic statement and click Search & Analyze.image

    • Search statements

      Search statements filter log data by time range, request type, keyword, or other conditions. They can be used alone. Query syntax and functions.

      Example: Query logs with status code 200:

      status:200

      Search statement examples.

    • Analytic statements

      Analytic statements aggregate, transform, and filter log data, computing metrics such as time-series averages or year-over-year and month-over-month comparisons. An analytic statement must follow a search statement in the search statement | analytic statement format. SQL analysis syntax and functions.

      Example: Count requests by status code:

      * | SELECT status, count(*) AS PV GROUP BY status

      SQL functions. SQL clauses.

    Note

    By default, clicking a Logstore in the Logstore list opens the Search & Analyze page and runs a query automatically. To change this behavior, click the Settings icon in the upper-right corner and use the Query Settings tab.

    image

    Configure a time range

    Set the time range for Search & Analyze using one of the following methods. Time ranges specified in analytic statements override the time picker.

    • In the time range picker at the top of the page, select a time range, such as 15 Minutes.image

    • In an analytic statement, use the __time__ field to specify a time range. Example:

      * | SELECT * FROM log WHERE __time__ > 1731297600 AND __time__ < 1731310038

    • In an analytic statement, use the from_unixtime function or to_unixtime function to convert time formats. Examples:

      • * | SELECT * FROM log WHERE from_unixtime(__time__) > from_unixtime(1731297600) AND from_unixtime(__time__) < now()
      • * | SELECT * FROM log WHERE __time__ > to_unixtime(date_parse('2024-10-19 15:46:05', '%Y-%m-%d %H:%i:%s')) AND __time__ < to_unixtime(now())
    Note

    By default, a query returns a maximum of 100 rows. To return more data, use the LIMIT clause.

    Query & Analysis page

    Page overviewimage

    Histogram

    image

    • Hover over a green block to view its time range and hit count.

    • Double-click a green block to drill into a finer time granularity. Results for that time range appear on the Raw Logs tab.

    Raw logs

    • Log detailsimage

      • Click Table or Raw Data to switch the log display format.

      • Download logs > Download Log: Download logs to your computer. Download logs.

      • image.png> JSON Settings: Set the display type and level for JSON logs.

      • image.png> Event Settings: Configure events for raw logs.

      • image.png: Copy the log content.

      • image.png: Use SLS Copilot to summarize information and find errors based on log content.

      • Query Logs-004: View a log entry in context within its original file. Available only for Logtail-collected logs. Contextual query.

      • LiveTail: Monitor logs in real time and extract key information. Available only for Logtail-collected logs. LiveTail.

    • Displayed fieldsimage

      • In the Displayed Fields section, click the image.png icon next to a field to remove it from Displayed Fields. The field no longer appears in logs on the right.

      • image.png: Save the current field selection to favorites. After you specify the fields to display in Area 5, select a saved view from the drop-down list above Area 4.

      • image.png> Tag Settings: Set a field as a system tag.

      • image.png> Alias: If you enable this feature, field names are replaced by their aliases. Fields without aliases keep their original names. Set field aliases in Create indexes.

    • Index fieldsimage

      • In the Indexed Fields section, click the image.png icon next to a field to add it to Displayed Fields. The field then appears in logs on the right.

      • image.png: View the Basic Distribution and Statistical Metrics of the field. Field settings.

    Graph

    A graph renders the visual output of a query and analytic statement. Simple Log Service supports tables, line charts, column charts, and more. Statistical charts. View results on the Graph tab. image

    Other features on this tab:

    • Add to New Dashboard: Save query and analysis results as a chart to a dashboard for real-time monitoring. Click Add to New Dashboard to add a chart. Visualization overview.

    • Save as Scheduled SQL Job: Periodically analyze data, store aggregated results, and project or filter data. Scheduled SQL.

    • Interaction Occurrences: Drill down into data by adjusting dimension hierarchy and analysis granularity. Add an interaction to a dashboard for drill-down analysis.

    LogReduceimage

    On the LogReduce tab, click Enable LogReduce to aggregate highly similar logs during collection. LogReduce.

    SQL enhancementimage

    Click the Dedicated SQL icon in the upper-right corner to enable Dedicated SQL for the current session. Dedicated SQL allocates additional computing resources for analyzing larger data volumes per query. To enable Dedicated SQL by default: High-performance, fully accurate query and analysis (Dedicated SQL).

    Alertingimage

    Click the Save as alert icon in the upper-right corner and select Save as Alert to create an alert rule based on the query and analysis results. Get started with alerting.

    Saved searchimage

    Click the Saved search icon in the upper-right corner to Save as Saved Search the current query and analysis statement. Use saved searches to quickly re-run frequent queries. Saved Search.

    Shareimage

    Click the image.png icon in the upper-right corner to copy and share the URL of the current page. Embed and share console pages.

    Data transformationimage

    Click Data Transformation in the upper-left corner to open the data transformation page. Transform data for normalization, extraction, cleansing, filtering, and distribution across multiple Logstores. Create a data transformation task (new version).

    Related documentation