Skip to main content

Log Query

The log service supports second-level querying of billions to hundreds of billions of log data entries. Through log querying, you can troubleshoot issues based on logs and analyze business data using field information parsed from logs. The log query feature supports the following capabilities:

  • View detailed information of individual logs in a list format.
  • Discover valuable information through aggregated statistics and display it via visual charts.
  • Group logs with similar structures for display, significantly facilitating your analysis process by eliminating the need to examine all detailed logs.

Prerequisites​

Logs have been processed through built-in or custom parsing pipelines, with relevant attributes or tags successfully parsed.

Getting Started​

Navigate to Log Analysis > Log Query to enter the log query interface.

The platform supports three query methods: List, Chart, and Pattern Recognition. Switch between these modes using the toggle buttons for different analysis scenarios.

Log List​

View logs in a list format. Click any log entry to access its detailed page.

Search Bar & Quick Filters​

image-20250930110541616

Use the search bar or quick filters to input query conditions and search logs. Click the query button to execute log data searches.

The platform provides powerful filtering components that allow you to narrow, expand, or adjust query scope using keywords, attributes, and tag information to pinpoint issues. Flexible query conditions are supported:

  • Numerical values: Equal to, Not equal to, Between, Greater than, Less than, Is empty, Is not empty
  • Text values: Equal to, Contains, Not equal to, Starts with, Is empty, Is not empty

image-20250930110457886

image-20250930110513553

The platform includes built-in common filter fields such as Index, Host, Source, Status, and other core fields to facilitate quick log filtering.

Quick filters provide statistical information about log data under current filter conditions, supporting View Only, View All, and Toggle Options buttons for convenient field selection.

image-20250930110426775

The platform supports one-click viewing of corresponding chart visualizations.

image-20250930110401440

For fields in quick filters, operations such as Show/Hide Column, Delete Column, and Associate with Standard Attributes are supported.

image-20250930110339803

Defining Fields​

In addition to the built-in preset attributes, users can also add fields from the parsed attributes to the quick filter. They can directly select fields from the registered parsed attributes for quick filter display.

Advanced settings support configuring display name, grouping, and description.

  • By default, Use path as display name (excluding @) is enabled. Uncheck to modify the display name. This only affects filter panel display, not log parsing fields.
  • Grouping (optional): Select from dropdown or create new group. Ungrouped fields are categorized as "Other".
  • Description (optional).

image-20260709195056012

Query Results​

For optimal search efficiency with large log volumes, select precise time ranges. Matched search fields are highlighted.

image-20250930110255949

The platform provides status distribution charts to view log counts by status dimension. Click or drag to filter logs within specific time ranges.

image-20250930110232292

Log Detail Page​

The log detail page displays all detailed information collected for the specific log entry.

Key information is presented in card format, including Host, Service, Process, Source, etc.

Tags include:

  • Built-in tags from the original log
  • Automatically appended tags based on collection logic
  • Tags configured in your collection settings

Original log content is stored, and event parsing attributes display structured information extracted or enhanced through processing pipelines.

Context Viewing: View contextual information based on collection path, host information, and log unique identifiers, simulating the experience of remotely accessing hosts and opening log files without the繁琐 steps.

Correlation Analysis: View metric trends from the host, container, or Pod entity where abnormal logs occurred, and examine entity attributes to assist with decisions like capacity expansion.

image-20250930110219206

Chart Analysis​

This mode supports statistical analysis of attribute values or log counts across multiple dimensions. View logs through trend charts, rankings, and tables.

Trend Charts​

The platform supports trend chart visualization of log information. Input conditions to query expected logs, select statistical objects and methods, and view data across up to 5 dimensions. Statistical objects must be fields defined in quick filters.

image-20250930110158584

Statistical Objects:

  • Qualitative (text): Statistical method fixed as Count. For other qualitative dimensions, fixed as Count Unique.
  • Quantitative (numerical): Default statistical method: Avg. Options: Avg, Max, Median, Min, Pc75, Pc90, Pc95, Pc98, Pc99, Sum.

Dimensions:

  • Default: "Everything" (no dimensional breakdown)
  • Click "Everything" to display all qualitative filter attributes

Sorting Configuration: Control the order of statistical information display.

  • Example: "Count unique services by status top 5 count by process"
  • Meaning: Show TOP 5 services by status, ordered by process count (descending)

Sorting supports both qualitative and quantitative types:

  • Qualitative (text): Options: all, other qualitative dimensions. "all" uses Count, other dimensions use Count Unique.
  • Quantitative (numerical): Default: Avg. Options: Avg, Max, Median, Min, Pc75, Pc90, Pc95, Pc98, Pc99, Sum.

Hovering over dimension-based status charts highlights similar data and displays corresponding statistical values.

image-20250930110143772

Interactive Chart Operations: Zoom, View Related Logs, Add Filter, Exclude Filter. Zooming focuses on specific time ranges.

image-20250930110127816

View Related Logs: Opens a drawer showing detailed log lists corresponding to chart elements. Related filter conditions appear in the drawer's filter box for granular data filtering and log detail examination.

image-20250930110113567

The list supports table header configuration and row count settings. Show/hide status distribution charts.

image-20250930110056830

Rankings​

View log information through ranking displays. Select one dimension for sorting. For multiple dimensions, use table mode. Each statistical entry supports viewing related logs and adding/excluding filter conditions.

image-20250930110023937

Tables​

View log information in table format.

image-20250930110005750

Tables display total counts for each dimension and support continuous dimensional breakdown. In this example:

  • First row: Total log count across all dimensions
  • Second row: Log count where logstatus is "unknown"
  • Third row: Log count where logstatus is "debug"

This approach provides intuitive statistical overviews across dimensions, facilitating user problem analysis.

Pattern Recognition​

Provides real-time analysis and clustering of log events for rapid anomaly identification. The platform supports viewing attribute values or log counts by custom dimensions, text similarity, and log status.

image-20250930105928001

The pattern detail page displays the most severe log level and pattern recognition statements. Supports both detailed view and statistical chart view. In detailed log lists, users can click to view log details. Statistical charts are generated from randomly sampled 2,000 log entries. Up to 50 log examples are displayed.

image-20250930105914250

Click statistical charts to view TOP data statistics for each field. Supports both full statistics and sampled statistics. Navigate between fields using next/previous buttons. Click yellow areas to directly locate field statistics.

  • Values with fewer than 50 unique entries: Displayed as enumerations
  • Values with 50+ unique entries: Displayed as charts

image-20250930105856151