Creating charts in time series mode FAQ - Simple Log Service

Key concepts

Important

Currently, only Line Chart (Pro) and Flow Chart (Pro) support time series mode.

Time series mode shows how one or more datasets change over a continuous period. You can merge results from multiple query and analysis statements for a more detailed, intuitive view of your data trends.

The time field is a default attribute for each log entry in Simple Log Service. It represents the time of a log that is specified when the log is written to Simple Log Service. The time field is a UNIX timestamp in seconds. You can use the time field to build statistical charts in time series mode and avoid complex time function operations.

The main differences between time series mode and non-time series mode are as follows:

Time series mode
- The system automatically optimizes the time span and distributes data points evenly.
- The time is displayed in the mm:ss format on the X-axis and in the YYYY-MM-DD hh:mm:ss format in the popover.
- You can add multiple query and analysis statements.
Non-time series mode
- Data points on the x-axis spread across a wide time range.
- On the x-axis and in the popover, time is displayed in the UNIX timestamp format. To change the format, you must use time functions in your query and analysis statement.
- You can add only one query and analysis statement.

Benefits

Provides a more uniform time distribution on the x-axis to better reflect metric changes.
Automatically optimizes the time scale on the x-axis to match the time span, revealing more details in the results.
The time on the X-axis is displayed in the mm:ss format to provide a more intuitive display of the time span and specific time points.
Supports adding multiple query and analysis statements and merging their results.

Limitations

The time field for the x-axis must be in the UNIX timestamp format (in seconds) or a standard time format. Supported standard formats include UTC time, such as 2022-02-03T22:30:05+08:00, or a format that can be parsed into year, month, day, hour, minute, and second, such as YYYY/MM/DD hh:mm:ss with an optional time zone.

Configuration examples

Prerequisites

A Standard Logstore is created. For more information, see Create a Logstore.
Logs are collected. For more information, see Data collection.
Indexes are configured. For more information, see Create indexes.

Example 1: Track daily PV and UV trends

时序模式

You can enable and configure time series mode when creating a chart. For detailed instructions on how to create and configure a line chart, see Add a chart to a dashboard and Line chart. The key configuration parameters are described below.

①: Select the Logstore that contains your logs and enter a query and analysis statement.
```
* | select __time__ - __time__ % 3600 as time, COUNT(*) as pv, COUNT(DISTINCT remote_addr) as uv group by time order by time limit 10000
```
- time - time % 3600 as time indicates a 1-hour time interval aliased as time.
- The remote_addr field indicates the IP address of the client and can be used to count the number of unique visitors (UV).
- The total number of logs is used to count page views (pv).
②: Set the query time range to 1 Day (Relative).
③: Click Apply to run the query and analysis statement.
④: On the Common Settings tab, in the Query and Analysis Configuration section, set the y-axis field to pv and uv.
⑤: Turn on the Time Series Mode switch.

Example 2: Monitor daily inbound and outbound traffic

时序模式

You can enable and configure time series mode when creating a chart. For detailed instructions on how to create and configure a line chart, see Add a chart to a dashboard and Line chart. The key configuration parameters are described below.

①: Select the Logstore that contains your logs and enter a query and analysis statement.
```
* | select  __time__ - __time__ % 3600 as time , sum(body_bytes_sent)* -1 as net_out, sum(request_length) as net_in group by time order by time limit 10000
```
- time - time % 3600 as time specifies a 1-hour time interval and an alias of time.
- The body_bytes_sent field indicates the number of bytes in the response body sent to the client. You can use this field to calculate outbound traffic.
- The request_length field represents the size of the request in bytes, including the request line, the request headers, and the request body. This field is used to measure inbound traffic.
②: Set the query time range to 1 Day (Relative).
③: Click Apply to run the query and analysis statement.
④: On the Common Settings tab, in the Query and Analysis Configuration section, set the y-axis field to net_out and net_in.
⑤: Turn on the Time Series Mode switch.