Saved search

Create a saved search

1. Log on to the Simple Log Service console.

2. In the Projects section, click the one you want.

   

3. On the Log Storage > Logstores tab, click the logstore you want.

   

4. Enter a query statement in the search box and click Last 15 Minutes to specify a query time range.

   For more information, see Step 1: Configure indexes.

5. In the upper-right corner of the page, click the icon.

   This is the Add to Saved Search (star) icon, located in the toolbar in the upper-right corner of the Search & Analysis page.

6. In the Saved Query Details pane, set the Saved Query Name.

7. Click OK.

   After creating a saved search, you can run it from the Search & Analysis page for the Logstore. Click the icon before the input box, and then click the name of the target saved search.

Modify a saved search

1. In the navigation pane on the left, choose Resources > Saved Search.

2. In the Saved Search list, click the target saved search.

3. Enter a new query and analysis statement, then click the icon.

4. In the upper-right corner of the page, click the icon.

5. In the Saved Query Details pane, modify the saved search information, and then click OK.

Get a saved search ID

After you create a saved search, you can use its saved search ID to embed the saved search page into a custom web page. For more information, see Configure console embedding parameters.

1. In the navigation pane on the left, choose Resources > Saved Search.

2. In the Saved Search list, click the target saved search.

3. Get the saved search ID in the URL in your browser's address bar.

   The URL in the address bar of the Log Service console is in the format https://sls.console.alibabacloud.com/lognext/project/{ProjectName}/savedsearch/{savedSearchID}?slsRegion={region}. The field between /savedsearch/ and ?slsRegion= is the saved search ID.

Pass variables with URL parameters

When embedding the Log Service console in an iframe or linking to a saved search page from an external system, you can append URL parameters to dynamically replace variable placeholders in the saved search's query statement.

Prerequisites

• You have a saved search whose query statement contains a variable placeholder, such as ${variable_name}.

• The token feature (tokenQuery mode) must be enabled for the saved search.

The standard URL for a saved search page is as follows:

/lognext/project/{ProjectName}/savedsearch/{savedSearchName}

You can append query parameters to this URL to pass variable values or add filter conditions. The following table describes the available parameters.

token parameter

The token parameter is a JSON array where each element is an object in the format {"key": "variable_name", "value": "replacement_value"}.

[{"key": "variable_name1", "value": "value1"}, {"key": "variable_name2", "value": "value2"}]

Example: Assume the query statement for the saved search my-search is * | WHERE status = ${testParam}. After you pass parameters by using the following URL, the query statement is replaced with * | WHERE status = '200':

/lognext/project/my-project/savedsearch/my-search?token=[{"key":"testParam","value":"200"}]

tokenInherit parameter

tokenInherit has the same format as token. It is typically passed automatically during a drill-down from a dashboard to allow a saved search to inherit selected variable values from the dashboard. When both token and tokenInherit are present, variables in token have a higher priority. For variables with the same key, the value from token is used.

filters parameter

The filters parameter prepends a filter condition to the query statement with an AND operator. Example:

/lognext/project/my-project/savedsearch/my-search?filters=level%3D"ERROR"

The resulting query statement is:

(level="ERROR") AND <Original query statement>

Parameter priority and application order

If multiple parameters are present, Log Service constructs the final query statement in the following order:

1. The system starts with the original statement of the saved search.

2. If the token or tokenInherit parameter exists, Log Service replaces the ${variable_name} placeholders in the statement.

3. If the filters parameter exists, Log Service prepends the filter condition to the statement by using an AND operator.

Complete example

The Project name is my-project, the Saved Search Name is error-query, and the query statement is * | WHERE status = ${statusCode} AND host = ${hostName}. You must pass the parameters statusCode=500 and hostName=web-server-01 and add the filter condition level="ERROR". The URL is constructed as follows:

/lognext/project/my-project/savedsearch/error-query?token=[{"key":"statusCode","value":"500"},{"key":"hostName","value":"web-server-01"}]&filters=level%3D"ERROR"

The resulting query statement is:

(level="ERROR") AND * | WHERE status = '500' AND host = 'web-server-01'

Using parameters in an iframe

If you embed the saved search page in a custom web page by using an iframe, you can dynamically concatenate parameters when you construct the src URL of the iframe:

<iframe
  src="/lognext/project/my-project/savedsearch/error-query?token=[{&quot;key&quot;:&quot;statusCode&quot;,&quot;value&quot;:&quot;500&quot;}]"
  width="100%"
  height="800px"
  frameborder="0"
/>

Alternatively, you can dynamically construct the URL in JavaScript:

const params = encodeURIComponent(JSON.stringify([
  { key: 'statusCode', value: '500' },
  { key: 'hostName', value: 'web-server-01' }
]))
const iframeSrc = `/lognext/project/my-project/savedsearch/error-query?token=${params}`
document.getElementById('sls-iframe').src = iframeSrc

Usage notes

• The value of the token parameter is a JSON array and must be URL-encoded (encodeURIComponent) in a URL.

• The variable name (key) must exactly match the token variable name defined in the saved search statement. The name is case-sensitive.

• If the Token feature is not enabled for a saved search (the tokenQuery parameter is empty), the token and tokenInherit parameters will not take effect, and the query statement will not be replaced.

• filters works regardless of whether the Token feature is enabled for saved searches.

Delete a saved search

In the navigation pane on the left, choose Resources > Saved Search. In the list of saved searches, hover over the target saved search, click the icon, and then click Delete.