This topic describes how to query the context of a log in a log file in the Simple Log Service console.
Prerequisites
Logs are collected by using Logtail. For more information, see Use Logtail to collect logs.
Important If you use a Logtail plug-in to process text logs or collect the stdout and stderr of a container, you must add the aggregators configuration to the Logtail plug-in configuration. For more information, see Configuration description.Indexes are configured. For more information, see Create indexes.
Background information
To perform a contextual query, you must specify a server, a log file, and a log whose context you want to query. The query operation returns the logs that are generated before or after the specified log and are collected from the log file of the server. This helps you identify and troubleshoot errors.
Scenarios
For example, a transaction on an online-to-offline (O2O) takeout app is recorded in an application log file on a server. A successful transaction involves the following operations: user logon, product browsing, product selection, product addition to the shopping cart, order placement, order payment, payment deduction, and order generation.
If the order replacement fails, O&M engineers must identify the causes of the failure at the earliest opportunity. In traditional contextual queries, O&M engineers must be granted the required permissions by an administrator before the engineers can log on to each server on which the O2O takeout app is deployed. After the permissions are granted, the O&M engineers can search application log files by order ID to identify the causes of the failure.
In Simple Log Service, the O&M engineers can perform the following steps to identify the causes of the failure:
Install Logtail on each server, create a machine group and a Logtail configuration in the Simple Log Service console, and then enable Logtail to upload incremental logs to Simple Log Service.
On the search and analysis page in the Simple Log Service console, specify a time range and find the log that records the failure by order ID.
After you find the log, scroll up until other related logs are found. For example, you may find a log that records a failure in credit card payment.
Benefits
You can identify the causes of failures without the need to modify applications or change the formats of log files.
You can query the context of a log from a log file that is generated on a server in the Simple Log Service console. You do not need to log on to the server to query the context.
You can specify a time range to obtain suspicious logs before you perform a contextual query in the Simple Log Service console. This improves troubleshooting efficiency.
You do not need to worry about data loss that is caused by insufficient server storage or log file rotation. You can view historical log data in the Simple Log Service console at any time.
Procedure
You can use the contextual query feature only on logs that are collected by using Logtail.
- Log on to the Log Service console.
- In the Projects section, click the project that you want to manage.
- On the tab, click the Logstore that you want to manage.
Enter a query statement, select a time range, and then click Search & Analyze.
On the tab, find the log whose context you want to query and click the
icon. 
On the page that appears, scroll up and down to view the contextual logs.
To scroll up, click Old.
To scroll down, click New.
To highlight strings, enter the strings in the Highlight field. Then, the strings are highlighted in red.
To filter logs by string, enter strings in the Filter By field. Then, the Context View section displays only the logs that contain the specified strings.
