SLS provides log consumption and log query features. Both read log data but differ in latency, cost, and use cases.
Log consumption
Works like Kafka: sequential (FIFO) read/write over full data.
-
Each Logstore has one or more shards. Data is written to a random shard.
-
Logs are read in batches from a specified shard in write order.
-
Set the start position (cursor) based on log receive time to begin batch reads from a shard.
Log query (LogSearch)
Query and analyze large volumes of logs. Supports conditional queries and SQL-based statistics.
-
Filter data with query conditions.
-
Combine conditions with AND, NOT, and OR operators. Collect SQL-based statistics on results.
-
Queries span all shards.
Differences
|
Feature |
Log query |
Log consumption |
|
Keyword search |
Supported |
Not supported |
|
Read small amounts of data |
Fast |
Fast |
|
Read full data |
Slow (100 ms per 100 logs). Not recommended. |
Fast (10 ms per 1 MB). Recommended. |
|
Distinguish reads by topic |
Differences |
Not supported. The shard is the only identifier. |
|
Distinguish reads by shard |
No. Queries span all shards. |
Required. Specify a target shard per read. |
|
Cost |
High |
Low |
|
Scenarios |
Monitoring, troubleshooting, and analysis. |
Full data processing: stream and batch processing. |