The SLS component integrates Simple Log Service (SLS) into SOAR playbooks, letting you query logs and write log entries as part of automated security response workflows.
Actions
| Action | Description |
|---|---|
run_query | Queries logs from an SLS Logstore. |
putLogs | Writes log entries to an SLS Logstore. |
Prerequisites
Before you begin, ensure that you have:
An SLS project and Logstore
An AccessKey ID and AccessKey secret with permission to operate Simple Log Service APIs
(For RAM users) The required Simple Log Service API permissions granted to the RAM user
Configure an instance
Configure the SLS connection before adding the component to a playbook.
Click the component node, then open the Basic Information Configuration tab and click Resource Instance Configuration.
On the Resource Instance Configuration page, click Add and fill in the following parameters.
| Parameter | Description | Required |
|---|---|---|
assetname | A name for this resource instance. Choose a name that identifies the SLS connection in your playbooks. | Yes |
end_point | The SLS service endpoint for your region. For a list of endpoints, see Service endpoints. | Yes |
sub_id | The AccessKey ID. To create an AccessKey, see Create an AccessKey. | Yes |
access_key | The AccessKey secret corresponding to the AccessKey ID. | Yes |
run_query
Queries logs from an SLS Logstore using SQL syntax.
Parameters
| Parameter | Description | Required |
|---|---|---|
project | The name of the SLS project to query. | Yes |
logstore | The name of the Logstore to query. | Yes |
endpoint | The SLS service endpoint. For a list of endpoints, see Service endpoints. | Yes |
query | The SQL query to run. For SQL syntax reference, see SQL syntax and functions. | Yes |
from | The query start time, in Unix epoch milliseconds. For example, <%=currentTimeToMs()- 100 * 60 * 1000L%> sets the start time to 100 minutes before the current time. | Yes |
to | The query end time, in Unix epoch milliseconds. For example, <%=currentTimeToMs()%> sets the end time to the current time. | Yes |
limit | The maximum number of log entries to return. Maximum value: 10,000. | No |
For more information about SQL syntax, see SQL syntax and functions.
You can also use the Simple Log Service Copilot tool to help you generate and optimize SQL query statements. For more information, see AI-powered query and analysis statement generation (Copilot).
If you use an analysis statement and limit exceeds 100, include an ORDER BY clause in your query. Without it, some results may be missing.
Example configuration
{
"actionName": "run_query",
"valueData": {
"project": "test_project",
"logstore": "test_logstore",
"endpoint": "cn-shangzhou.log.aliyuncs.com",
"query": "*",
"from": "<%=currentTimeToMs()- 100 * 60 * 1000L%>",
"to": "<%=currentTimeToMs()%>",
"limit": "10"
}
}putLogs
Writes log entries to an SLS Logstore.
Parameters
| Parameter | Description | Required |
|---|---|---|
project | The name of the SLS project to write to. | Yes |
logstore | The name of the Logstore to write to. | Yes |
endpoint | The SLS service endpoint. | Yes |
topic | A user-defined label for the batch of log entries. Use this field to group or filter logs. | No |
logItems | The log data to write, as a JSON string. Supports JSON objects and JSON arrays—for example, {"test":"test"}. A _logUuid field is automatically added to each entry as a unique identifier, which you can use to query recently written logs. | Yes |
Example configuration
{
"actionName": "putLogs",
"valueData": {
"project": "test_project",
"logstore": "test_logstore",
"endpoint": "cn-shangzhou.log.aliyuncs.com",
"topic": "test",
"logItems": "{\"test\":\"test\"}"
}
}Import as a test playbook
You can import the example configurations as a test playbook to explore and validate the component in the visual flow editor.
Save the full playbook JSON (see below) as a
.jsonfile.Import the file following the steps in Playbook import.
The following JSON contains both actions in sequence: run_query first, then putLogs using the query results.