How do I use quotation marks in query statements? - Simple Log Service

This topic describes how to use quotation marks in query statements.

Usage notes

In Simple Log Service, each query statement consists of a search statement and an analytic statement in the Search statement|Analytic statement format. The results that are returned after you use quotation marks in query statements vary based on the types of quotation marks and statement types. The following table describes the usage of each type of quotation marks in query statements.

Type of quotation marks

Search statement

Analytic statement (SQL statement)

Single quotation marks ('')

Not supported.

You must use single quotation marks ('') to enclose the characters that represent a string.

Double quotation marks ("")

If a field name or a field value contains special characters such as space characters and Chinese characters, or contains syntax keywords such as AND and OR, you must enclose the characters in double quotation marks ("").

The characters that are enclosed in a pair of double quotation marks ("") indicate a proper noun, such as a filed name or a table name.

If a proper noun, such as a field name or a table name, contains special characters such as space characters and Chinese characters, or contains syntax keywords such as AND and OR, you must enclose the characters in double quotation marks ("").

Examples

In this example, logs in which the value of the request method field contains PUT are queried.
The name of the request method field contains a space character. You must enclose the field name in double quotation marks ("") in a search statement.
```
"request method":PUT
```
In this example, logs in which the value of the region field contains cn* are queried.
In this search statement, cn* is a complete word. If the content of a log is region:cn*,en and the delimiter is a comma (,), Simple Log Service splits the log content into region, cn*, and en. You can use the following search statement to search for the log:
```
region:"cn*"
```
In this example, the top 10 request durations are calculated.
The name of the top 10 column contains a space character. You must enclose the column name in double quotation marks ("").
```
* | SELECT max(request_time,10) AS "top 10"
```
In this example, the number of logs is calculated by status code.
The index of the content field is of the JSON type. For more information, see How do I query and analyze an indexed JSON field?
```
* | SELECT "content.status", COUNT(*) AS PV GROUP BY "content.status"
```