通過Scan搜尋實現上下文查詢

程式碼範例

1. 在pom.xml檔案中添加如下依賴。

   <!-- https://mvnrepository.com/artifact/com.aliyun.openservices/aliyun-log -->
   <dependency>
       <groupId>com.aliyun.openservices</groupId>
       <artifactId>aliyun-log</artifactId>
       <version>0.6.120</version>
   </dependency>

2. 使用如下代碼。根據實際情況替換參數project、logStore、endpoint、accessKeyId和accessKeySecret，Log Service的公網網域名稱，擷取方式請參見服務存取點，使用者身份識別ID，擷取方式，請參見建立AccessKey。

   import com.aliyun.openservices.log.Client;
   import com.aliyun.openservices.log.common.QueriedLog;
   import com.aliyun.openservices.log.exception.LogException;
   import com.aliyun.openservices.log.response.GetLogsResponse;
   public class DoScanTest {
       // 本樣本從環境變數中擷取AccessKey ID和AccessKey Secret。
       static String accessKeyId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
       static String accessKeySecret = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
       //Log Service的服務存取點。此處以杭州為例，其它地區請根據實際情況填寫。
       static String host = "cn-hangzhou.log.aliyuncs.com";
       //初始化Log Serviceclient
       static Client client = new Client(host, accessKeyId, accessKeySecret);
       public static void main(String[] args) throws LogException {
           String project = "test-project";
           String logStore = "test-logstore";
           int fromTime = 1740985125;      // event-time, [from, to)
           int toTime = 1740985125 + 7200; // event-time, [from, to)
           // String query = "Status:404 | where http_host = 'www.yt.mock.com'";      // 不返回上下文資訊
           String query = "Status:404 | where http_host = 'www.yt.mock.com' | with_pack_meta";    // 返回上下文資訊
           int totalCount = 0;
           // boolean reverse = false;  // 從前向後尋找
           boolean reverse = true; // 從後向前尋找
           boolean forward = true;
           int offset = 0;
           while (true) {
               GetLogsResponse resp = client.GetLogs(project, logStore, fromTime, toTime, "", query, 100, offset, reverse, forward, "mode=scan;");
               for (QueriedLog log : resp.getLogs()) {
                   System.out.println(log.GetLogItem().ToJsonString());
               }
               System.out.println("[response of this scan]\tbegin offset: " + resp.GetBeginOffset() + "\tend offset: " + resp.GetEndOffset() + "\tresult logs: " + resp.getLogs().size() + "\tis finished: " + resp.IsScanAll());
               totalCount += resp.getLogs().size();
               if (resp.IsScanAll()) {
                   break;
               }
               offset = forward ? (int) resp.GetEndOffset() : (int) resp.GetBeginOffset();
           }
           System.out.println("totally scanned logs\t: " + totalCount);
       }
   }

   SDK參數說明

   reverse	forward	offset	行為
   false	true	0 或上次請求響應的 endOffset。	從前（時間戳記小）往後（時間戳記大）翻頁。
   true	true	0 或上次請求響應的 endOffset。	從後（時間戳記大）往前（時間戳記小）翻頁。
   false	false	索引命中的日誌總數或上次請求響應的 beginOffset。	從後（時間戳記大）往前（時間戳記小）翻頁。
   true	false	索引命中的日誌總數或上次請求響應的 beginOffset。	從前（時間戳記小）往後（時間戳記大）翻頁。

3. 運行輸出。

   {
       "referer": "www.xxx.xxx.xxx",
       "slbid": "slb-01",
       "scheme": "https",
       "vpc_id": "8c093000-9f68-2c0f-a904-5c612483505a",
       "upstream_addr": "125.36.xx.xx",
       "owner_id": "owner-01",
       "body_bytes_sent": "1733",
       "request_method": "GET",
       "http_host": "www.yt.mock.com",
       "http_user_agent": "Mozilla/4.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/11.0.1245.0 Safari/537.36",
       "remote_user": "0iu9d",
       "upstream_status": "200",
       "vip_addr": "139.207.xxx.xxx",
       "request_time": "24",
       "__pack_meta__": "0|MTczNjkzNzIxNzg2NDA5NT****==|287|277",
       "__tag__:__pack_id__":"5253859C5169****-3",
       "host": "www.xxx.xxx.xxx",
       "client_ip": "58.19.XXX.XX",
       "user_agent": "Mozilla/5.0 (Windows NT 7.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.112 Safari/534.30",
       "remote_addr": "183.70.XX.XXX",
       "__topic__": "nginx_access_log",
       "instance_name": "instance-01",
       "time_local": "03/Mar/2025:08:02:34",
       "request_uri": "/request/path-2/file-4",
       "instance_id": "i-01",
       "request_length": "4458",
       "http_x_forwarded_for": "103.96.xxx.xxx",
       "upstream_response_time": "30",
       "network_type": "vlan",
       "region": "cn-shanghai",
       "logtime": 1740988954,
       "server_protocol": "HTTP/2.0",
       "status": "404"
   }
   [response of this scan]	begin offset: 0	end offset: 1	result logs: 1	is finished: true
   totally scanned logs	: 1
   Process finished with exit code 0

4. 上下文資訊。

   在代碼中，當Scan 文法是{Index Search Query} | {Scan Query}時，返回的日誌資訊中不包含內容欄位。帶內容欄位返回的文法是 {Index Search Query} | {Scan Query} | with_pack_meta。

   如上程式碼範例中，返回的日誌內容欄位如下：

   __pack_meta__: 0|MTczNjkzNzIxNzg2NDA5NT****==|287|277
   __tag__:__pack_id__: 5253859C5169****-3

   ​有了這些上下文資訊後，您可以參考GetContextLogs獲得這條日誌在原始檔案中的上一條和下一條。