Writing real-time and accurate Structured Process Language (SPL) search statements can be a challenge when you need to extract key information, transform data formats, or perform statistical analysis on large and complex logs. Copilot for SPL is an AI assistant built into Simple Log Service that understands your natural language instructions to help you generate, explain, and diagnose SPL statements. This capability makes log data transformation easier and improves analysis efficiency.
Procedure
Log on to the Simple Log Service console.
Click the name of the source Project.
In the navigation pane on the left, click
Task Management.On the Data Transformation tab, click Create Data Transformation Job. Then, select the source Logstore and click Confirm.
On the transformation statement editor page, click
to open the O&M Assistant dialog box.NoteBy default, the first three statements of the raw logs are added as context for the Large Language Model (LLM).
Before you enter your request in natural language, select a mode to help the system better understand and respond to your request. The following three modes are supported:
Generate SPL: Automatically generates executable SPL transformation statements based on a natural language description.
SPL Q&A: Provides answers about SPL syntax, function usage, and best practices.
Diagnose SPL: Checks SPL statements for syntax errors and suggests fixes.
Enter your request in natural language or the SPL statement that you want to analyze.
Review the AI-generated output and click Run query to add the output to the SPL statement editor.
If the AI-generated statement is not accurate, you can use a multi-turn conversation to obtain a more accurate statement.
Examples for different modes
Generate SPL
The following is an example of a raw log to be transformed:
[
{
"content": "[2025-11-27 11:11:08,232][1a2b3c4d-5e6f-4789-a0b1-c2d3e][INFO] curl -H 'Host: 'http://sls.console.aliyun.com:8080/etl/api -d {\"APIVersion\":\"0.6.0\",\"AccessKeyId\":\"STS.NZ*****eq\",\"AccessKeySecret\":\"123\"}"
}
]The following example shows a multi-turn conversation with the AI assistant:
First turn
User request: Structure this log
AI assistant response:
* | parse-regexp content, '\[([^]]+)\]\[([^]]+)\]\[([^]]+)\]\s+(.*)' as timestamp, trace_id, level, request_part
| extend headers = regexp_extract(request_part, "-H\s+'([^']+)'", 1),
body_str = regexp_extract(request_part, "-d\s+'(\{[^}]+\})'", 1),
url = regexp_extract(request_part, "'(http[^\s']+)'", 1),
method = regexp_extract(request_part, '-X\s+(\w+)', 1)
| parse-json body_strSecond turn
User request: First, extract the JSON part from the content field, and then extract data from the JSON.
AI assistant response:
* | extend json_str = regexp_extract(content, '\{.*\}')
| extend parsed_json = json_parse(json_str)
| parse-json parsed_jsonThird turn
User request: Filter for data where the level is ERROR.
AI assistant response:
* | extend json_str = regexp_extract(content, '\{.*\}')
| extend parsed_json = json_parse(json_str)
| parse-json parsed_json
| where level = 'ERROR'SPL Q&A
User request: How to package JSON
AI assistant response:
Correct answer: Use the pack-fields instruction.
For example: * | pack-fields -include='\w+' as packed_json
This statement packages all fields into a JSON object named packed_json.
SPL tips:
The pack-fields instruction is designed for packaging fields.
-include='\w+' includes all fields. \w+ is a regular expression that matches letters, numbers, and underscores.
To package only specific fields, use a statement such as pack-fields request_info = method, uri, status.
For example: If you have the fields method=GET, uri=/api/v1/users, and status=200, the statement produces the following result: packed_json = {"method":"GET","uri":"/api/v1/users","status":"200"}Diagnose SPL
User request:
* | ||pack-fields -include='\w+' as packed_jsonAI assistant response:
Your SPL statement has a clear syntax error: * | ||pack-fields -include='\w+' as packed_json
Cause:
In SPL, the pipe character | is used to connect instructions. You wrote || (two consecutive pipe characters), which is invalid syntax.
The correct syntax is:
* | pack-fields -include='\w+' as packed_json
Suggestions:
Delete the extra | and keep a single pipe character.
If you want to package specific fields, use a more precise list of fields, for example:
pack-fields method, uri, status as packed_json