What is Simple Log Service - Simple Log Service - Alibaba Cloud Documentation Center

Simple Log Service (SLS) is a cloud-native observability and analytics platform that provides large-scale, low-cost, real-time services for Log, Metric, Trace, and other data. It offers a one-stop solution for data collection, transformation, query and analysis, visualization, alerting, consumption, and shipping, comprehensively enhancing your digital capabilities in development, operations, maintenance, security, and other scenarios.

What can Simple Log Service do

Log management scenarios

Provides complete data collection capabilities from clients, servers, and cloud products.
Supports tiered storage to meet the needs of data at different lifecycle stages.
Supports PB-level query and analysis processing daily, quickly responding to business needs.

Unified data pipeline/data lake

Supports dozens of collection methods for unified real-time collection of massive data.
Used for processing, cleaning, real-time consumption, and distribution, adapting to business analytics, big data analytics, etc.
Serves as an enterprise data pipeline and data bus.

Business analytics and monitoring platform

Integrates system data with business data to provide real-time insights.
Helps prevent system risks and adjust business strategies, achieving real-time or minute-level data analysis compared to T+1 display in BI systems.

Full-stack observability operations platform

Supports unified storage and joint analysis of observable data such as Log/Metric/Trace.
Integrates AIOps tools such as intelligent inspection, intelligent prediction, and root cause analysis to achieve anomaly detection and automatic alerting, improving system stability and user experience.

Log security analytics, audit, and classified protection compliance

Builds a unified log security audit solution across multiple accounts and regions.
Automatically collects logs from new instances with centralized storage to support audit functions.
Includes built-in audit policies and can connect to third-party SIEM systems.

Why choose Simple Log Service

Provides comprehensive and unified data access solutions: Capable of ingesting Log, Metric, and Trace data, fully covering IoT, mobile, and server-side. You can also use Simple Log Service to collect logs from cloud services, open source systems, multi-cloud environments, and on-premises servers. High collection efficiency with low resource consumption, stable and reliable, ensuring no data loss or errors.
Provides a one-stop platform service: Covers the entire lifecycle management including data collection, analysis, processing, visualization, shipping, and alerting.
Unified storage platform: Solves backend storage heterogeneity issues and supports connection to stream computing platforms.
Intelligent and efficient data analysis capabilities: Analyzes hundreds of billions of logs in seconds, integrates AIOps tools, and provides intelligent anomaly detection and root cause analysis capabilities.
Problem troubleshooting and alerting: Supports infrastructure monitoring, intelligent noise reduction to eliminate alert storms, and improves localization efficiency.
Provides elastic, low-cost cloud services: Supports PB-level elastic scaling daily, pay-as-you-go, reducing TCO by more than 50%.
Provides ready-to-use applications: Such as CloudLens observability, FinOps cost analysis, etc., supports open ecosystems, and is compatible with multiple open-source engines.

Features

Data collection

Supports unified collection of observable data (such as Log/Metric/Trace) from various sources including client logs, IoT devices, server and application logs, standard protocols, and Alibaba Cloud product logs. It also supports multiple network transmission methods such as internal network, public network, and Global Accelerator. It completely bridges data across accounts, across clouds, and between cloud and on-premises scenarios, while ensuring stable and reliable collection through features like breakpoint continuation and elastic scaling.

Data processing and transformation

Simple Log Service provides out-of-the-box, fully managed, horizontally scalable, real-time processing functions for data structuring, enrichment, forwarding, desensitization, and filtering. It includes rich processing functions, text processing operators, and has streaming high-throughput capabilities. Processing can be performed during data collection, at write time, or after writing, with results visible in seconds.

Data storage

Simple Log Service provides a unified storage platform that breaks down data silos and supports intelligent storage tiering management. Through lifecycle management, hot data is automatically converted to queryable cold data, reducing long-term storage costs. Storage redundancy ensures data durability and stability while maintaining capabilities for querying, analyzing, visualizing, alerting, shipping, and processing data. It supports scenario-based specification selection, offering more cost-effective query-oriented storage specifications for pure query scenarios.

Query and analysis

Simple Log Service supports second-level querying of hundreds of billions of logs based on data indexing and analysis, along with lightweight query and analysis capabilities based on scanning mode. The log engine includes nearly 100 query and analysis functions. It also supports intelligent machine learning algorithms such as inspection, anomaly detection, and root cause analysis, along with scheduled SQL queries and high-performance exact queries (SQL exclusive). You can also query with external data sources or use third-party tools for querying.

Visualization

Simple Log Service includes rich built-in dashboards that support visualization of query and analysis results, providing more than 10 types of statistical charts, including tables, line charts, bar charts, maps, etc. It also supports custom dashboards based on statistical charts (supporting console embedding and drill-down analysis) and integration with third-party visualization systems (such as Grafana and QuickBI).

Alerting

Provides a one-stop alerting function, including alert monitoring, alert management, notification (action) management, etc. It supports unified alerting across multiple sources, accounts, and conditions, with intelligent noise reduction to eliminate alert storms and realize the true value of alerts. Supports multiple notification methods including phone calls, text messages, DingTalk, WeChat, Lark, webhooks, etc.

Data output and integration

Simple Log Service maximizes openness and compatibility with upstream and downstream data sources, seamlessly integrating with dozens of open-source or self-developed big data systems. It supports data consumption and subscription, such as Spark Streaming consumption, Flume consumption, Flink consumption, and other scenarios. It also supports real-time data shipping, such as shipping data to OSS, MaxCompute, TSDB, and other cloud products.

Log audit

Log Audit Service supports all features of Simple Log Service. Log Audit Service also supports automated and centralized log collection from cloud services across Alibaba Cloud accounts in real time. Then, you can audit the collected logs. In addition, Log Audit Service stores data required for audit and lets you query and aggregate the data.

Billing

Simple Log Service supports the pay-as-you-go billing method. You are charged based on your actual usage. Compared with a self-managed approach to deploy the Elasticsearch, Logstash, and Kibana (ELK) stack, Simple Log Service lets you reduce the total cost by 50%. For information about the metering items and billing items of Simple Log Service, see Billing items of the pay-by-feature billing method and Billing items of the pay-by-data-volume billing method. If you want to stop billing, see How to disable Simple Log Service or stop billing.

Getting started

We recommend that you follow these steps to get started with Simple Log Service:

	Preparation	Start data ingestion	Data applications after ingestion
Note	Understanding Simple Log Service concepts will help you use the service better.	Transfer data to Simple Log Service for subsequent applications.	Classic application scenarios for data in Simple Log Service.
Basic steps	Activate Simple Log Service. Click Simple Log Service console to go to the activation page. Learn about Project resources. Learn about Store resources. Learn about data collection methods.	Create a project. Create the desired type of store. Logstore MetricStore EventStore Select the appropriate data type for ingestion. Logs: Log data collection (Log) Metrics: Metric data collection (Metric) Traces: Trace data collection (Trace) Events: Event data collection (Event)	Data query and analysis Index-based query and analysis Scan-based query and analysis (Scan) Data monitoring Visualize data using dashboards Quickly set up log-based alerting
Optional/advanced steps	Understand storage resource hierarchy and plan (resource lifecycle, scale, flow control, etc.). RAM and access control: Simple Log Service RAM access control configuration.	Understand differences between data processors and process data (format parsing, filtering, encryption, desensitization). Storage strategy: Optimize storage strategy by setting storage lifecycle through intelligent storage tiering management.	Use cross-domain query and analysis (Storeview dataset) for querying data across different Logstores. Use high-performance fully accurate query and analysis (SQL exclusive) for large data volumes to ensure accurate results. Implement data forwarding and data enrichment through data processing. Interact with third-party systems through data consumption and subscription and data shipping.

Usage methods

The following table describes the methods that you can use to use Simple Log Service.

Method	Description
Console	Simple Log Service provides a web console to manage your Simple Log Service resources. Simple Log Service console.
SDK	Simple Log Service provides SDKs for various programming languages to facilitate custom development. For more information, see SDK Overview.
API	Simple Log Service provides the API to manage your Simple Log Service resources. This method requires you to sign API requests. For more information, see API overview. Note We recommend that you use SDKs to avoid signature verification.
CLI	Simple Log Service provides a command-line interface (CLI) to manage your Simple Log Service resources. For more information, see CLI overview.

FAQ

Will Alibaba Cloud use my data stored in Simple Log Service?

Alibaba Cloud does not use or disclose your business data without authorization, except to fulfill your service requests or to comply with legal and regulatory requirements. For more information, see Service terms.

Does Alibaba Cloud store its own data in Simple Log Service?

Yes. Simple Log Service is the internal logging and monitoring platform of Alibaba Group. It has demonstrated its stability and reliability during Double 11 events over the years. Alibaba Cloud developers also use Simple Log Service in many projects.

How does Simple Log Service ensure service stability during sudden traffic spikes?

Simple Log Service provides a self-adaptive data architecture that supports auto scaling to process petabytes of data per day. This architecture helps Simple Log Service handle traffic spikes and business peaks.

How to disable Simple Log Service or stop billing

For more information, see How to disable Simple Log Service or stop billing.

How long can data be retained in Simple Log Service?

You can set data to be permanently retained or only retained for a specified period. Data that exceeds the specified retention period will be automatically deleted. You can also enable intelligent storage tiering to convert data that exceeds a specific time period into low-frequency or archive data to reduce storage costs.