Simple Log Service:Glossary

Term

Description

Project

A Project is the basic resource management unit in Log Service. It serves as the primary boundary for multi-user isolation and access control. For more information, see Project.

LogStore

A LogStore is the unit for collecting, storing, and querying log data in Log Service. For more information, see LogStore.

MetricStore

A MetricStore is the unit for collecting, storing, and querying metric data in Log Service. For more information, see MetricStore.

log

A log is a record of an event that occurs in a system. It contains information about what happened and when, forming a time-ordered sequence of operations and their outcomes. For more information, see log.

LogGroup

A LogGroup is a collection of logs and serves as the basic unit for writing and reading data. All logs in a LogGroup share the same metadata, such as an IP address and source. For more information, see LogGroup.

metric

A metric is a numerical measurement of a system's state or performance captured over time. For more information, see metric.

trace

A trace represents the execution path of a transaction or process within a distributed system. For more information, see trace.

shard

A shard controls the read and write throughput of a LogStore. All data is stored in a specific shard. Each shard corresponds to a left-closed, right-open MD5 hash range. These ranges do not overlap and together cover the entire MD5 value space, from [00000000000000000000000000000000 to ffffffffffffffffffffffffffffffff). For more information, see shard.

topic

Log Service uses the topic that you specify during log collection to categorize logs. For more information, see topic.

endpoint

An endpoint is the URL used to access a Project and its data. Different regions have different endpoints. Within the same region, endpoints also differ for internal and public network access. For more information, see Service endpoints.

AccessKey

An AccessKey consists of an AccessKey ID and an AccessKey Secret, which are used for identity authentication. Log Service uses the AccessKey ID and AccessKey Secret to verify the identity of a request sender through symmetric encryption. The AccessKey ID identifies the user, and the AccessKey Secret is a key used by the user to encrypt the signature string and by Log Service to verify it. The AccessKey Secret must be kept confidential. For more information, see AccessKey.

region

A region is the physical location of a Log Service data center. You must select a region when you create a Project, and this selection cannot be changed later. For more information, see Available regions.

Term

Description

Logtail

Logtail is a log collection agent provided by Log Service. For more information, see Logtail (Legacy Collector).

Logtail configuration

A Logtail configuration defines the policies that Logtail uses to collect logs, including the log file location and collection method. For more information, see Logtail configuration (Legacy).

machine group

A machine group is a virtual group of servers. Log Service uses machine groups to manage all servers from which Logtail collects logs. For more information, see machine group.

Term

Description

query

A query returns matching logs based on filtering rules specified in a query statement. For more information, see Query overview.

analysis

Analysis uses SQL functions to perform calculations on query results and returns an aggregated result.

• Log analysis supports standard SQL-92 syntax. For more information, see Overview of query and analysis.

• Metric analysis supports both standard SQL-92 and PromQL syntax. For more information, see Query and analysis syntax for metrics.

query and analysis statement

A query and analysis statement follows the format of query statement | analysis statement. You can use a query statement alone, but an analysis statement requires a query statement. This means that analysis runs on either query results or the full dataset. For more information, see Query and analysis.

index

An index is an inverted data structure that consists of keywords and logical pointers to the actual data. It functions like a table of contents for your data, allowing you to quickly locate specific data rows based on keywords. You must configure an index before you can run queries. Log Service provides two types of indexes:

• full-text index: Log Service splits an entire log entry into words based on the delimiters you specify and then builds an index. When you run a query, Log Service treats both the field name (key) and field value as plain text.

• field index: After you configure a field index, you can query data by specifying a key-value pair to narrow the search scope.

For more information, see Create an index.

Standard SQL

Standard SQL is a free resource for SQL analysis. It has stricter resource limits than Dedicated SQL.

Dedicated SQL

Dedicated SQL is a paid resource provided by Log Service for SQL analysis. You can use Dedicated SQL when you need to analyze large-scale data, ranging from tens to hundreds of billions of records. For more information, see High-performance and precise query and analysis (Dedicated SQL).

Term

Description

DSL

DSL is a Python-compatible scripting language for data transformation in Log Service. For more information, see Language overview.

transformation rule

A transformation rule is a data transformation script written in the Log Service DSL. For more information, see Syntax overview.

Term

Description

consumer group

Log Service allows you to consume data using consumer groups. A consumer group consists of multiple consumers that collectively consume log data from a LogStore. Consumers within the same group do not consume the same data twice. For more information, see Consume logs by using a consumer group.

Term

Description

alert

When used independently, alert refers to an alert event. For example, when an alert monitoring rule triggers, it generates one or more alerts. These alerts are passed to the alert management system and then to the notification management system.

When used as part of a compound term, alert refers to a component of the alerting feature, such as an alert monitoring system or an alert monitoring rule.

For more information, see What is Log Service Alert?.

alert monitoring

This is an alert subsystem responsible for generating alerts. It is composed of alert monitoring rules and resource data.

This system periodically runs checks based on configured alert monitoring rules. It evaluates the query and analysis results to trigger alerts or recovery notifications and then sends them to the alert management system.

alert management

This is an alert subsystem that reduces alert noise and manages alert statuses. It consists of alert policies, incident management, and an alert dashboard.

The alert management system uses alert policies to route, suppress, deduplicate, silence, or merge the alerts it receives, and then sends them to the notification management system. It also supports setting incident phases and assigning handlers.

notification management

This is an alert subsystem responsible for managing notification channels and recipients. It consists of action policies, content templates, calendars, users, user groups, on-call groups, and channel quotas.

The notification management system uses action policies to dynamically route alerts to specific notification channels, which then notify the target users, user groups, or on-call groups. It also supports features like alert notification escalation and customized notification content.