StoreView overview

What is a StoreView

In an SLS project, a StoreView is a virtual resource that defines relationships between the Logstores or Metricstores it covers. You can query data across stores through a StoreView, but cannot modify data. Two types exist: StoreView for Logstore supports querying, analysis, and predefinition with SPL syntax. StoreView for Metricstore supports cross-Metricstore queries only.

In a Log Data View or Time Series Data View, you can query data across Logstores or Metricstores. For example, if Logstore1 and Logstore2 both contain an age field and are associated in Storeview1, querying age in Storeview1 returns matching results from both.

Permissions

To use a StoreView as a RAM user or RAM role, you must have the required permissions. Grant permissions through Create a RAM user and grant permissions, Create a RAM role for an Alibaba Cloud service and grant permissions to the RAM role, and Use a RAM role for cross-account resource access.

You can grant permissions by using a system policy or a custom policy.

• System policy: Predefined by Alibaba Cloud. You can use but not modify these policies.

  • Read-only permissions for Simple Log Service: AliyunLogReadOnlyAccess.

  • Full management permissions for Simple Log Service: AliyunLogFullAccess.

• Custom policy: User-defined policies that you create and manage.

  • To create a StoreView or query data as a RAM user or RAM role, you must have permission to query logs in a Logstore on all associated Logstores and Metricstores. Add the following statement to your custom policy:

    Important

    • In a policy, Logstore can refer to either a Logstore or a Metricstore.

    • In a policy, storeview can refer to both a Log Data View and a Time Series Data View.

    {
      "Version": "1",
      "Statement": [
        {
          "Action": "log:GetLogStoreLogs",
          "Resource":[
            "acs:log:*:*:project/${projectName}/Logstore/*",
            "acs:log:*:*:project/${projectName}/storeview/*"
          ],
          "Effect": "Allow"
        }
      ]
    }

Limitations

• Up to 10 Log Data View or Time Series Data View in each Simple Log Service project.

• Each Log Data View or Time Series Data View can be associated with a maximum of 50 Logstores or Metricstores.

• All Logstores or Metricstores in a Log Data View or Time Series Data View must belong to the same Alibaba Cloud account.

• Storeviews support cross-region analysis only within the Chinese mainland. Cross-border analysis is not supported.

Predefinition

Concept

A StoreView for Logstore supports predefinition using SPL syntax when created. Predefined queries support only SPL commands and functions, and the keywords of SPL commands and functions. Use predefinition to filter data or align field names for aggregation. For example, to aggregate the a field from LogStore1 and the b field from LogStore2, use extend a = b to align column names. Example.

Limitations

Predefinition is supported only for StoreView for Logstore, not for StoreView for Metricstore.

Supported commands

Predefined queries in a StoreView for Logstore support the operators in SPL commands and functions and SPL commands and functions.

For SQL and SPL functions, see Function overview.

Examples

To create or modify a StoreView for Logstore, see Create a Storeview for Logstore.

For example, if you need to aggregate field a from Logstore1 and field b from Logstore2, you can use extend a = b (predefinition) when you create or modify a storeview to make the column names consistent.

Example 1

If you predefine * | where a>1 in Logstore1, only the logs in the StoreView that match a>1 are included in subsequent analysis.

The actual query is * | where cast(a as integer) > 1. The data preview table shows that the values for a in the filtered logs are 10 and 9, both of which are greater than 1.

Example 2

In Logstore1, predefining * | extend b = a adds a column named b to Logstore1 in the StoreView. This column has the same values as column a and is used for subsequent aggregation.

After predefining extend b = a, the data preview table shows that a new column b is added to Logstore1, and its values are the same as those in column a.

Query

Storeview for Logstore

A StoreView for Logstore supports cross-Logstore queries. For example, if a Log Data View is associated with LogStore-1 and LogStore-2, and both Logstores contain the request_method field, the query (request_method:GET or request_method:POST) and status in [200 299] returns matching logs from both LogStore-1 and LogStore-2. For query syntax, see Query syntax and features.

If a Log Data View contains two Logstores with identical log content, a keyword search returns all results from both Logstores. You can use the tag field to identify the source Logstore for each log.

In the query results, each log is identified by the __tag__:__logstore__ tag field, which indicates its source Logstore. For example, a value of logstore-2 indicates that the log is from Logstore-2.

Storeview for Metricstore

A StoreView for Metricstore supports cross-store queries. If a StoreView for Metricstore is associated with metricstore1 and metricstore2, enter a PromQL statement in the query box. The backend automatically queries all associated Metricstores. For query syntax, see Syntax for querying and analyzing metric data. To create or modify a StoreView for Metricstore, see Query data across Metricstores.

In the Create StoreView dialog box, enter a StoreView Name, such as metric_storeview_test, select Time Series for StoreView Type, add the desired Metricstores in the Associated Stores area, and then click OK.

Analysis

Concept

Data View supports cross-store aggregation and analysis. For example, if a StoreView is associated with LogStore-1 and LogStore-2, and both Logstores contain the field a, the query * | select a, count(1) group by a returns the total count for field a from both LogStore-1 and LogStore-2.

Aggregation requires consistent field keys. Use predefinition to filter data and rename fields when key names differ. Predefinition capabilities.

Limitations

Data analysis is supported only for StoreView for Logstore, not for StoreView for Metricstore.

Supported functions

For SQL and SPL functions, see Function overview.

Examples

Example 1

A Log Data View is associated with Logstores from the same service with identical log content. Ensure the index configurations are identical across Logstores (for example, full-text indexing enabled or field indexes configured the same way). Then add the Logstores to the Log Data View.

After you create a Log Data View, you can use SQL for analysis. The statistical results for different status values in the last 15 minutes are the aggregated results of all logs from the two Logstores.

The query statement is SELECT status, count(*) AS PV GROUP BY status. The query result shows PV=4 for status=200 and PV=8 for status=302.

Example 2

A Log Data View is associated with different Logstores from the same service, but some of their log fields have different names. In this case, you can use a predefined SPL to align the field names. Use the SPL statement *|extend request_method = method to rename the method field to the request_method field. Click Preview data to preview the results of the predefinition.

Later, you can use request_method to perform query analysis.

Run the query * | SELECT request_method, count(*) GROUP BY request_method order by request_method desc in the storeview_test Storeview. The chart shows 4 requests where request_method is GET and 1 request where request_method is null.

StoreView vs. Store

Related operations

• Query and analyze data across Logstores

• Query data across Metricstores