Simple Log Service:What is Simple Log Service?

Key capabilities

Log management

• Comprehensive collection from clients, servers, and cloud products.

• Offers tiered storage (hot, cold, archive) with lifecycle management to reduce long-term costs.

• Supports PB-scale query and analysis processing daily, quickly responding to business needs.

Unified data pipeline and data lake integration

• Supports dozens of collection methods for unified real-time collection of massive data.

• Used for processing, cleaning, real-time consumption, and distribution, adapting to business analytics, big data analytics, and more.

• Serves as an enterprise data pipeline and data bus.

Business analytics and monitoring platform

• Integrates system data with business data to provide real-time insights.

• Helps prevent system risks and adjust business strategies, achieving real-time or minute-level data analysis compared to T+1 display in BI systems.

Full-stack observability operations platform

• Supports unified storage and joint analysis of observable data such as Log/Metric/Trace.

• Integrates AIOps tools such as intelligent inspection, intelligent prediction, and root cause analysis to achieve anomaly detection and automatic alerting, improving system stability and user experience.

Log security analytics, auditing, and compliance

• Builds a unified log security audit solution across multiple accounts and regions.

• Automatically collects logs from new instances with centralized storage to support audit functions.

• Includes built-in audit policies and can connect to third-party Security Information and Event Management (SIEM) systems.

Why choose SLS?

• Unified data ingestion

  • One pipeline for logs, metrics, and traces.

  • IoT devices, mobile apps, backend services—one SDK covers them all.

  • Works with cloud-native logs, open-source stacks, multi-cloud deployments, and on-prem servers.

  • Lightweight collectors keep CPU and memory use predictable while keeping data loss risk low.

• A complete, one-stop platform

  • Collection, transformation, search, visualization, shipping, alerting.

  • Every stage of the lifecycle is in the same console, so context stays intact and hand-offs disappear.

• A single storage backbone

  • Abstracts away heterogeneous storage engines.

  • The same dataset is ready for ad-hoc queries or real-time stream processing.

• Fast, assisted analytics

  • Interactive queries on tens of billions of records finish in seconds.

  • Built-in AIOps detects anomalies and suggests probable root causes.

• Noise-aware alerting and troubleshooting

  • Infrastructure metrics feed the same platform.

  • Noise-reduction algorithms cut alert storms and shorten mean-time-to-resolution.

• Elastic, cost-efficient cloud delivery

  • Scales to multiple petabytes of data per day, on demand.

  • Pay-as-you-go pricing often trims total cost of ownership by half compared with self-managed stacks.

• Out-of-the-box applications

  • CloudLens for end-to-end observability.

  • FinOps dashboards for cost insights.

  • Open ecosystem compatible with popular open-source engines.

Features

Data collection

Supports unified collection of observable data (such as Log/Metric/Trace) from various sources including client logs, IoT devices, server and application logs, standard protocols, and Alibaba Cloud product logs. It also supports multiple network transmission methods such as internal network, public network, and Global Accelerator. It completely bridges data across accounts, across clouds, and between cloud and on-premises scenarios, while ensuring stable and reliable collection through features like resumable uploads and elastic scaling.

Data processing and transformation

SLS provides out-of-the-box, fully managed, horizontally scalable, real-time processing functions for data structuring, enrichment, forwarding, desensitization, and filtering. It includes rich processing functions, text processing operators, and has streaming high-throughput capabilities. Processing can be performed during data collection, at write time, or after writing, with results visible in seconds.

Data storage

SLS provides a unified storage platform that breaks down data silos and supports intelligent storage tiering management. Through lifecycle management, hot data is automatically converted to queryable cold data, reducing long-term storage costs. Storage redundancy ensures data durability and stability while maintaining capabilities for querying, analyzing, visualizing, alerting, shipping, and processing data. It supports scenario-based specification selection, offering more cost-effective query-oriented storage specifications for pure query scenarios.

Query and analysis

SLS supports index-based query and analysis of tens of billions of logs, along with lightweight query and analysis capabilities based on scanning mode. The log engine includes nearly 100 query and analysis functions. It also supports intelligent machine learning algorithms such as inspection, anomaly detection, and root cause analysis, along with scheduled SQL queries and high-performance fully accurate query and analysis (Dedicated SQL). You can also query with external data sources or use third-party tools for querying.

Visualization

SLS includes rich built-in dashboards that support visualization of query and analysis results, providing more than 10 types of statistical charts, including tables, line charts, bar charts, and maps. It also supports custom dashboards based on statistical charts (supporting console embedding and drill-down analysis) and integration with third-party visualization systems (such as Grafana and Quick BI).

Alerting

Provides a one-stop alerting function, including alert monitoring, alert management, and notification management. It supports unified alerting across multiple sources, accounts, and conditions, with intelligent noise reduction to eliminate alert storms and make alerts more actionable. Supports multiple notification methods including phone calls, text messages, DingTalk, WeChat, Lark, and webhooks.

Data output and integration

SLS maximizes openness and compatibility with upstream and downstream data sources, seamlessly integrating with dozens of open-source or self-developed big data systems. It supports data consumption and subscription, such as Spark Streaming consumption, Flume consumption, Flink consumption, and other scenarios. It also supports real-time data shipping, such as shipping data to OSS, MaxCompute, and other cloud products.

Log audit

Log audit service builds on SLS to provide real-time, automated, and centralized log collection for auditing across multiple Alibaba Cloud accounts. It includes dedicated storage, query, and aggregation features to meet compliance requirements.

Billing

SLS supports the pay-as-you-go billing method. You are charged based on your actual usage. Compared to a self-managed Elasticsearch, Logstash, and Kibana (ELK) stack, SLS can reduce your total cost of ownership (TCO) by 50% or more. For more information, see Billable items of pay-by-feature and Billable items of pay-by-ingested-data. To stop billing, see Stop billing.

Getting started

We recommend that you follow these steps to get started with SLS:

FAQs

How do I disable SLS or stop billing?

To stop billing for SLS, you must take action in two key areas: data collection and resource storage.

1. Stop log collection: After stopping collection, the collector will no longer transmit new logs.

2. Clean up storage resources: Delete the corresponding project and logstore in SLS. Ensure all associated resources are removed to avoid charges for storage space usage.

For more information, see Stop billing.