GetLogs-阿里云帮助中心

Queries log data in a specified Logstore of a specified project. **[Deprecated]** Use the GetLogsV2 operation instead.

Operation description

Note

Simple Log Service allows you to create scheduled SQL nodes. For more information, see Create a scheduled SQL node.

The Host in the request syntax consists of the project name and the Simple Log Service endpoint. You must specify the project in the Host.
An AccessKey pair is created and obtained. For more information, see AccessKey pair.

An Alibaba Cloud account AccessKey pair has access permissions on all API operations, which poses high risks. Create and use a RAM user to invoke API operations or perform routine O&M. The RAM user must have the permissions to perform operations on Simple Log Service resources. For more information, see Create a RAM user and grant permissions to the RAM user.

The name of the project to which the logs you want to query belong, the region, and the name of the Logstore are determined. For more information, see Manage a project and Manage a Logstore.
Simple Log Service has limits on log queries. Design reasonable query and analysis statements, and configure appropriate query time ranges. For more information, see Limits on log queries and Limits on log analysis.
Indexes are configured before you query logs. For more information, see Create indexes.
When the number of logs involved in a query changes significantly, the Simple Log Service API cannot predict how many times this operation must be invoked to obtain the complete results. Therefore, you must check the x-log-progress status value in the response of each request to determine whether you need to repeatedly invoke this operation to obtain the final complete results. Each repeated invocation of this operation consumes the same number of query CUs.
After logs are written to a Logstore, the latency for the Simple Log Service query operations (GetHistograms and GetLogs) to retrieve the logs varies based on the written log type. Simple Log Service classifies logs into the following two categories based on the log UNIX timestamp:
- Real-time data: The time point in the log is within the range of (current server time - 180 seconds, current server time + 900 seconds]. For example, if the log time is UTC 2014-09-25 12:03:00 and the server receives the log at UTC 2014-09-25 12:05:00, the log is processed as real-time data. This usually occurs in normal scenarios.
- Historical data: The time point in the log is within the range of [current server time - 7 × 86400 seconds, current server time - 180 seconds). For example, if the log time is UTC 2014-09-25 12:00:00 and the server receives the log at UTC 2014-09-25 12:05:00, the log is processed as historical data. This usually occurs in data backfill scenarios. The latency from writing real-time data to making it queryable is about 3 seconds.

Note

Simple Log Service calculates the difference between the log time (field name: time) and the server receipt time (field name: tag:receive_time). If the difference is within the range of (-180 seconds, 900 seconds], the data is real-time data. If the difference is within the range of [-7 × 86400 seconds, -180 seconds), the data is historical data.

Simple Log Service provides GetLogs query examples for Java and Python SDKs. For more information, see Java GetLogs example and Python GetLogs example.

Authentication resources

The following table lists the authentication information corresponding to the API operation. You can add this information to the Action element of a RAM access policy statement to grant RAM users or RAM roles the permissions to invoke this API operation.

Action	Resource in authorization policy
`log:GetLogStoreLogs`	`acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request syntax

POST /logstores/{logstore}/logs HTTP/1.1

Path Parameters

Parameter	Type	Required	Description	Example
logstore	string	Yes	The name of the Logstore.	example-logstore

Request parameters

Parameter	Type	Required	Description	Example
project	string	Yes	The name of the project.	ali-test-project
Accept-Encoding	string	No	The compression method.	lz4
body	object	No	The request struct.
from	integer	Yes	The start time of the query. This time refers to the log time specified when log data is written. The time range defined by the from and to request parameters follows the left-closed and right-open principle, which means the time range includes the start time but excludes the end time. If the values of from and to are the same, the time range is invalid, and the function directly returns an error. The time is a UNIX timestamp representing the number of seconds that have elapsed since 00:00:00 UTC on January 1, 1970.	1627268185
to	integer	Yes	The end time of the query. This time refers to the log time specified when log data is written. The time range defined by the from and to request parameters follows the left-closed and right-open principle, which means the time range includes the start time but excludes the end time. If the values of from and to are the same, the time range is invalid, and the function directly returns an error. The time is a UNIX timestamp representing the number of seconds that have elapsed since 00:00:00 UTC on January 1, 1970.	1627268185
line	integer	No	The maximum number of logs to return. This parameter is valid only when the query parameter is a query statement. Minimum value: 0. Maximum value: 100. Default value: 100.	100
offset	integer	No	The offset of the query. This parameter is valid only when the query parameter is a query statement. Default value: 0.	0
reverse	boolean	No	Specifies whether to return logs in descending order of log UNIX timestamps, accurate to the minute. Valid values: true: Returns logs in descending order of log UNIX timestamps. false: Returns logs in ascending order of log UNIX timestamps. This is the default value. Note When the query parameter is a query statement, the reverse parameter is valid and specifies the sorting of returned logs. When the query parameter is a query and analysis statement, the reverse parameter is invalid. The sorting is specified by the ORDER BY syntax in the SQL analytic statement. If ORDER BY is ASC (default), the sorting is ascending. If ORDER BY is DESC, the sorting is descending.	false
powerSql	boolean	No	Specifies whether to enable Dedicated SQL. Default value: false.	false
session	string	No	The query parameters.	mode=scan
topic	string	No	The log topic.	topic
query	string	No	The query or analysis statement. For more information, see Query overview and Analysis overview. To use Dedicated SQL, add set session parallel_sql=true; to the analytic statement in the query parameter. Example: * \| set session parallel_sql=true; select count(*) as pv. Note: When the query parameter contains an analytic statement (SQL statement), the line and offset parameters of this operation are invalid. Set these parameters to 0 and use the LIMIT syntax in the SQL statement for paging. For more information, see Paginate query and analysis results.	status: 401 \| SELECT remote_addr,COUNT(*) as pv GROUP by remote_addr ORDER by pv desc limit 5
forward	boolean	No	Specifies whether to page forward or backward in a scan or phrase query.	false
highlight	boolean	No	Specifies whether to enable highlighting.	false
isAccurate	boolean	No	Specifies whether to enable nanosecond-level ordering.	true

Response elements

Element	Type	Description	Example
	object	The log array. Each element in the array is a log.
meta	object	The metadata.
progress	string	Indicates whether the query results are complete.	Complete
aggQuery	string	The SPL statement for aggregation and analysis.	select *
whereQuery	string	The SPL statement for filter conditions.	*
hasSQL	boolean	Indicates whether the query is an SQL query.	false
processedRows	integer	The number of rows processed in this query.	10000
elapsedMillisecond	integer	The time consumed by this query, in milliseconds.	5
cpuSec	number	The core-hours consumed by Dedicated SQL.	0.002
cpuCores	integer	The number of CPU cores used.	3
keys	array	The list of result column names.
	string	The list of result column names.	key
terms	array<object>	The types and aggregation information of columns.
	object	The types and aggregation information of columns.	{term=*, key=}
limited	integer	The limit on the number of entries. This is returned if the SQL statement does not contain a LIMIT clause.	100
mode	integer	The query mode enumeration. Valid values: 0: Normal query (including SQL) 1: Phrase query 2: SCAN 3: SCAN SQL	0
phraseQueryInfo	object	The phrase query information.
scanAll	boolean	Indicates whether all logs have been scanned.	true
beginOffset	integer	The start offset after index filtering for the current scan results.	0
endOffset	integer	The end offset after index filtering for the current scan results.	0
endTime	integer	The end time after index filtering for the current scan results.	1760530000000
scanBytes	integer	The amount of scanned data returned during a scan, in bytes.	1024
highlights	array<object>	The highlighted content.
	object	The highlighted content.
count	integer	The number of log rows returned by this query request.	6
processedBytes	integer	The volume of logs processed in the query.	10000
isAccurate	boolean	Specifies whether to enable nanosecond-level ordering.	true
columnTypes	array	The meta.columnTypes field provides a mapping from column names to data types (string, long, double, or json).
	string	The data type.	long
telementryType	string	The observable data type.	None
data	array<object>	The returned data.
	object	The returned data.
	string	The returned data.	[]

Examples

Success response

JSON format

{
  "meta": {
    "progress": "Complete",
    "aggQuery": "select *",
    "whereQuery": "*",
    "hasSQL": false,
    "processedRows": 10000,
    "elapsedMillisecond": 5,
    "cpuSec": 0.002,
    "cpuCores": 3,
    "keys": [
      "key"
    ],
    "terms": [
      {
        "test": "test",
        "test2": 1
      }
    ],
    "limited": 100,
    "mode": 0,
    "phraseQueryInfo": {
      "scanAll": true,
      "beginOffset": 0,
      "endOffset": 0,
      "endTime": 1760530000000
    },
    "scanBytes": 1024,
    "highlights": [
      {
        "test": "test",
        "test2": 1
      }
    ],
    "count": 6,
    "processedBytes": 10000,
    "isAccurate": true,
    "columnTypes": [
      "long"
    ],
    "telementryType": "None"
  },
  "data": [
    {
      "key": "[]"
    }
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.