Query and analysis with a Storeview-Simple Log Service(SLS)-阿里云帮助中心

Create a Storeview for Logstore

Prerequisites

A project and a Standard logstore are created, and logs are collected. For more information, see Manage projects, Create a basic logstore, and Data collection.

Procedure

Log on to the Simple Log Service console. In the Projects list, click the target project.
In the left-side navigation pane, choose Data View > Log Data View. Then, click Create Now or to create a Log Data View.
In the Create Storeview dialog box, enter a Storeview Name, add the logstores to associate, and then click OK. It takes about one minute to create the Storeview.
Note
- Each Simple Log Service project supports a maximum of 10 Log Data View.
- Each Log Data View can be associated with a maximum of 50 logstores.
- All logstores in a Log Data View must belong to the same Alibaba Cloud account.

Query feature

Log Data View supports cross-Logstore queries. For example, if a Log Data View is associated with two Logstores, LogStore-1 and LogStore-2, and both contain field a, the query * | select a from log where a > 1 returns logs from both LogStore-1 and LogStore-2 where field a meets the condition a > 1.

If a Log Data View contains two logstores with identical log content, a keyword query returns all matching results from both logstores. You can use the tag field to identify the source logstore for each log entry.

In the log details of the query results, you can use the __tag__:__logstore__ field to identify the source logstore of a log entry. For example, the value logstore-2 indicates that the log entry is from logstore-2.

Analysis feature

A Data View supports aggregation analysis across multiple logstores. For example, if a Storeview is associated with logstore-1 and logstore-2, and both contain a field named a, the query * | select a, count(1) group by a returns the total count for each value of the a field, aggregated from both logstores.

Aggregation analysis requires consistent field keys. For scenarios where logstores have similar content but different field names, you can use predefinition to filter data or rename fields. For example, to aggregate field a from logstore-1 and field b from logstore-2, you must first rename field b to a.

Note

When you create a Log Data View, you can apply an SPL predefinition to its associated logstores. Predefinition supports only the extend and where keywords. This allows you to filter data or resolve inconsistent field naming, which is useful for aggregation analysis. For example, to aggregate field a from logstore-1 and field b from logstore-2, you must use an expression like extend a = b to align the field names.

Consider the following two scenarios:

Scenario 1:

A Log Data View is associated with different logstores from the same service, and their log content is identical. In this scenario, first verify that the logstores' index configurations are compatible. For example, ensure they all use full-text indexing, or that the required fields have the same index configuration. Then, add the required logstores to the Log Data View.

After creating the Log Data View, you can use SQL for analysis. An analysis of different status values over the last 15 minutes aggregates logs from both logstores.

For example, the SQL statement * | SELECT status, count(*) AS PV GROUP BY status shows 4 PV for status 200 and 8 PV for status 302.
Scenario 2:

A Log Data View is associated with different logstores from the same service, but some log fields have different names. In this case, you can use SPL predefinition to create a new field with a consistent name. For example, use the SPL statement *|extend request_method = method to rename the method field to request_method. Click Preview Data to see the predefinition results.

You can then use the request_method field in your queries and analysis.

For example, enter the SQL statement * | SELECT request_method, count(*) GROUP BY request_method order by request_method desc in the query editor. Click Query/Analysis and view the result on the Statistics Chart tab. The result shows 4 GET requests and 1 null request.

Query and analysis examples

Scenario	Predefined query	Query statement	Result
logstore-1 and logstore-2 both contain the `key` field.	None	`key:123`	Returns rows that contain `key:123`.
logstore-1 and logstore-2 both contain fields `a` and `b`.	None	`*\| select a where b=1`	Returns all values of field `a` where `b = 1`.
logstore-1 and logstore-2 both contain fields `key` and `a`.	`key:123`	`*\| select a`	Returns all values of field `a` that satisfy `key:123`.
logstore-1 and logstore-2 both contain fields `key` and `a`.	`key:123\|where a>1`	`*\| select a`	Returns values of field `a` that satisfy both `key:123` and `a > 1`.
logstore-1 and logstore-2 both contain fields `key` and `a`.	`key:123\|where a>1 \|extend y=upper(a)`	`\| select `	Returns all fields that meet the conditions, including the new field `y`.
logstore-1 contains fields `a`, `b`, and `c`. logstore-2 contains fields `b`, `c`, and `d`.	None	`select a,b,c,d`	Returns fields `a`, `b`, `c`, and `d`. Fields that do not exist in a log entry are returned as null.
logstore-1 has index fields `a` and `b`. logstore-2 has index fields `b` and `c`.	None	`a:* and b:* \| select a, count(1) group by a`	Because the `a` field does not exist in logstore-2, only data from logstore-1 is aggregated.

Handling inconsistencies

A query can still return results even if the same field has different data types across logstores.
If an analysis query involves a field that exists in only some of the associated logstores, the query returns results only from those logstores.
An analysis statement fails and returns an error if it involves fields with inconsistent index configurations across logstores.

Next steps

Query a Storeview

In the left-side navigation pane, choose Data View > Log Data View to view your created Storeviews for Logstore.

Update a Storeview

In the list of Storeviews, hover over the target Storeview, click the icon, and then click Modify.
In the Update Storeview panel, you can modify the associated logstores and then click OK.

In the Stores section, select the project and logstore (logstore or SQL store) for each store. You can click + STORE to add more stores.

Delete a Storeview

In the list of Storeviews, hover over the target Storeview, click the icon, and then click Delete.

Query and analyze data across logstores