All Products
Search
Document Center

Simple Log Service:What do I do if no results are returned when I query a log?

Last Updated:Aug 08, 2023

This topic describes how to troubleshoot the issue that no results are returned when you query a log in the Simple Log Service console.

Log collection failures

If the log is not collected to Simple Log Service, no results are returned when you query the log. You can check whether the log appears in the Preview Data section of the Configure Query and Analysis step. If yes, the log is collected to Simple Log Service. We recommend that you proceed with troubleshooting based on other possible reasons. If no, proceed with troubleshooting based on the following reasons:

  • The log is not generated in the log source.

    Check your log source.

  • Logtail has no heartbeats.

    On the Machine Group Status page, check whether Logtail that is installed on your server has a heartbeat. If Logtail has no heartbeats, see What do I do if no heartbeat connections are detected on Logtail?

  • The log file from which logs are collected has no data written in real time.

    Open the /usr/local/ilogtail/ilogtail.LOG file to view detailed error information. The following list describes common error messages:

    • parse delimiter log fail: The error message returned because an error occurs when Simple Log Service collects logs in delimiter mode.

    • parse regex log fail: The error message returned because an error occurs when Simple Log Service collects logs in full regex mode.

Delimiter configuration errors

You can view the delimiter that you specify, use the delimiter to split a log, and then check whether you can obtain a keyword based on which you can query the log. For example, the delimiter ,;=()[]{}?@&<>/:' is used to split the log abc"defg,hij, and abc"defg and hij are obtained. If you use hij to query the log, the log is returned. If you use abc to query the log, no results are returned.

Note
  • To reduce your index costs, we recommend that you use field indexes. For more information, see Index types.

  • The indexing feature takes effect only on the log data that is written after you configure indexes. If you want to query and analyze historical data, you can use the reindexing feature. For more information, see Reindex logs for a Logstore.

    In the Search & Analysis panel, you can check whether the delimiter that you specify meets the requirements. For more information, see Create indexes.

Other reasons

  • Check whether the time of the log falls in the time range of your query.

  • Simple Log Service allows you to preview logs in real time, but the query feature may cause a maximum of 1-minute latency. We recommend that you query logs at least 1 minute after the logs are generated.

If the issue persists, submit a ticket.