How do I use quotation marks in query statements?

When you query and analyze logs, you must enclose certain field names, table names, or field values in quotation marks, especially when they contain spaces, special characters, or syntax keywords.

Use quotation marks in search statements

Description

If a field name or field value contains special characters such as spaces and Chinese characters, or syntax keywords such as AND or OR, enclose the field name or field value in double quotation marks (""). For more information about search syntax, see Search syntax.

Examples

Query logs whose request method field value contains PUT. Because the field name contains a space, enclose it in double quotation marks ("") in the search statement.
```
"request method":PUT
```
Query logs whose remote_user field value is an empty string.
```
remote_user:""
```
Query logs whose region field value contains cn*.
cn* is a string. If a log entry is region:cn*,en and the delimiter is a comma (,), Simple Log Service splits the value into region, cn*, and en. Use the following search statement to find the log entry:
```
region:"cn*"
```

Using quotes in an analytic statement (SELECT statement)

Description

If a proper noun such as a field name or table name contains special characters such as spaces and Chinese characters, or syntax keywords such as AND or OR, enclose the proper noun in double quotation marks ("") in analytic statements. An analytic statement includes a SELECT statement.
Enclose string literals in single quotation marks (''). Characters without quotation marks or in double quotation marks ("") represent a field name or column name. For example, 'status' represents the string `status`, while status or "status" represents the `status` log field.

Examples

Calculate the top 10 requests with the longest duration.

The top 10 column name contains a space, so enclose it in double quotation marks ("").
```
* | SELECT max(request_time,10) AS "top 10"
```

Query logs whose IP addresses match 192.168.XX.XX.

* | select * from log where key like '192.168.%.%'

Calculate the number of request logs by status code.

The content field is indexed with the JSON data type. For more information, see How do I query and analyze an indexed JSON field?
```
* | SELECT "content.status", COUNT(*) AS PV GROUP BY "content.status"
```