GetLogsV2-阿里云帮助中心

Query raw log data from a specified Logstore in a project. The response returns raw logs within a given time range. Results are compressed during transmission.

Operation description

Specify the compression method correctly. Different programming languages implement different compression algorithms. For details, see the Accept-Encoding request parameter.
For more information, see GetLogs.

Authorization resources

The following table lists the authorization information for this API. Add this information to the Action element of a RAM access policy to grant RAM users or roles permission to call this API.

Action	Resource description in authorization policy
`log:GetLogStoreLogs`	`acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}`

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request syntax

POST /logstores/{logstore}/logs HTTP/1.1

Path Parameters

Parameter	Type	Required	Description	Example
logstore	string	Yes	The Logstore name.	test-logstore

Request parameters

Parameter	Type	Required	Description	Example
project	string	Yes	The project name.	ali-test-project
Accept-Encoding	string	No	The compression method for the response body. SDK users do not need to specify this. The SDK handles compression and decompression automatically. Java, Python, and Go support lz4 and gzip decompression. PHP, JavaScript, and C# support only gzip decompression. Valid values: lz4 : lz4 gzip : gzip	lz4
body	object	No	The request struct.
from	integer	Yes	The time range defined by the from and to parameters follows a left-closed right-open interval. This means the interval includes the start time but excludes the end time. If from and to have the same value, the interval is invalid and the function returns an error immediately. Use a UNIX timestamp format, which represents the number of seconds since 1970-01-01 00:00:00 UTC.	1627268185
to	integer	Yes	The time range defined by the from and to parameters follows a left-closed right-open interval. This means the interval includes the start time but excludes the end time. If from and to have the same value, the interval is invalid and the function returns an error immediately. Use a UNIX timestamp format, which represents the number of seconds since 1970-01-01 00:00:00 UTC.	1627268185
line	integer	No	The maximum number of log entries to return. This parameter applies only when the query parameter contains a query statement (not an SQL analytic statement). Minimum value: 0. Maximum value: 100. Default value: 100.	100
offset	integer	No	The starting row of the query. This parameter applies only when the query parameter contains a query statement (not an SQL analytic statement). Values start from 0. Default value: 0.	0
reverse	boolean	No	Specifies whether to return logs in descending order by timestamp, accurate to the minute level. This parameter applies only when the query parameter contains a query statement (not an SQL analytic statement). true: Return logs in descending order by timestamp. false (default): Return logs in ascending order by timestamp. To sort results in an SQL analytic statement, use the ORDER BY syntax. Use ASC (default) for ascending order or DESC for descending order.	false
powerSql	boolean	No	Enable Exclusive SQL. Disabled by default.	false
session	string	No	Query parameter.	mode=scan
topic	string	No	The log topic. Default value: empty.	""
query	string	No	A query statement or analytic statement. For more information, see Query Overview and Analysis Overview. Add set session parallel_sql=true; to the analytic statement in the query parameter to use Exclusive SQL. Example: * \| set session parallel_sql=true; select count(*) as pv. Note: When the query parameter contains an analytic statement (SQL), the line and offset parameters are ignored. Set them to 0 and use the LIMIT clause in your SQL statement for pagination. For more information, see Paginate query and analysis results.	status: 401 \| SELECT remote_addr,COUNT(*) as pv GROUP by remote_addr ORDER by pv desc limit 5
forward	boolean	No	For scan or phrase queries, specifies whether to paginate forward or backward.	false
highlight	boolean	No	Enable highlighting.	false
isAccurate	boolean	No	Enable nanosecond-level ordering.	true

Response elements

Element	Type	Description	Example
	object	Response data.
meta	object	Metadata of the response.
progress	string	Indicates whether the query result is complete. Complete: The query finished and returned a complete result. Incomplete: The query finished but returned an incomplete result. Repeat the request to get the full result.	Complete
aggQuery	string	The SQL part of the query statement after the \| symbol.	select *
whereQuery	string	The part of the query statement before the \| symbol.	*
hasSQL	boolean	Indicates whether the query is an SQL query.	false
processedRows	integer	The number of rows processed in this query.	10000
elapsedMillisecond	integer	The time consumed by this query, in milliseconds.	5
cpuSec	number	Core-hours for Exclusive SQL.	0.002
cpuCores	integer	The number of CPU cores used.	3
keys	array	All keys in the query result.
	string	A key.	key
terms	array<object>	All terms in the query statement.
	object	A term.	{term=*, key=}
limited	integer	The limit on the number of results. Returned when an SQL query does not include a LIMIT clause.	100
mode	integer	Query mode enumeration: 0: Standard query (including SQL) 1: Phrase query 2: SCAN scan 3: SCAN SQL	0
phraseQueryInfo	object	Phrase query information.
scanAll	boolean	Indicates whether all logs have been scanned.	true
beginOffset	integer	The starting offset after index filtering for this scan result.	0
endOffset	integer	The ending offset after index filtering for this scan result.	0
endTime	integer	The latest timestamp after index filtering for this scan result.	1
scanBytes	integer	The data volume scanned (in bytes) during a scan operation.	1024
highlights	array	Highlighted content.
	array	Highlighted content.
	LogContent	The highlighted log content.
count	integer	The number of log lines returned in this query.	1
processedBytes	integer	The volume of logs processed by the query.	10000
isAccurate	boolean	Indicates whether nanosecond-level ordering is enabled.	true
columnTypes	array	Column types.
	string	Type.	long
telementryType	string	Observable data type.	None
data	array<object>	The response results.
	object	The returned data.
	string	The returned data.	{'remote_addr': '198.51.XXX.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'}

Examples

Success response

JSON format

{
  "meta": {
    "progress": "Complete",
    "aggQuery": "select *",
    "whereQuery": "*",
    "hasSQL": false,
    "processedRows": 10000,
    "elapsedMillisecond": 5,
    "cpuSec": 0.002,
    "cpuCores": 3,
    "keys": [
      "key"
    ],
    "terms": [
      {
        "test": "test",
        "test2": 1
      }
    ],
    "limited": 100,
    "mode": 0,
    "phraseQueryInfo": {
      "scanAll": true,
      "beginOffset": 0,
      "endOffset": 0,
      "endTime": 1
    },
    "scanBytes": 1024,
    "highlights": [
      [
        {
          "Key": "key-test",
          "Value": "value-test"
        }
      ]
    ],
    "count": 1,
    "processedBytes": 10000,
    "isAccurate": true,
    "columnTypes": [
      "long"
    ],
    "telementryType": "None"
  },
  "data": [
    {
      "key": "{'remote_addr': '198.51.XXX.XXX', 'pv': '1', '__source__': '', '__time__': '1649902984'}"
    }
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.