Use the Python SDK to manage saved searches

Save frequently used query statements as saved searches for quick reuse. The following Python SDK code samples show how to create, modify, list, and delete saved searches.

Prerequisites

Simple Log Service is activated.
Simple Log Service SDK for Python is initialized.

Simple Log Service SDK for Python is installed. For more information, see Install Simple Log Service SDK for Python.
A project and a Standard logstore are created, and logs are collected. For more information, see Manage projects, Create a basic logstore, and Data collection.

Precautions

In this example, the public Simple Log Service endpoint for the China (Hangzhou) region is used. Endpoint: https://cn-hangzhou.log.aliyuncs.com.

If you want to access Simple Log Service from other Alibaba Cloud services that reside in the same region as your project, you can use the internal Simple Log Service endpoint, which is https://cn-hangzhou-intranet.log.aliyuncs.com.

For more information about the supported regions and endpoints of Simple Log Service, see Endpoint.

Raw log

body_bytes_sent:1750
host:www.example.com
http_referer:www.example.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XX.XX
remote_addr:203.0.XX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
http_code:200
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

Create a saved search

Create a saved search named ali-test-savedsearch:

from aliyun.log import LogClient
import os

# This example obtains the AccessKey ID and AccessKey secret from environment variables.
accessKeyId = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID', '')
accessKey = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET', '')
# The endpoint of Simple Log Service. This example uses the endpoint of the China (Hangzhou) region. Replace it with the actual endpoint.
endpoint = "cn-hangzhou.log.aliyuncs.com"
# Create a Simple Log Service client.
client = LogClient(endpoint, accessKeyId, accessKey)

# The project name.
project_name = "ali-test-project"
# The Logstore name.
logstore_name = "ali-test-logstore"
# The saved search name.
savedsearch_name = "ali-test-savedsearch"

# Count the number of logs for failed GET or POST requests.
query = "(request_method:GET or request_method:POST) not status in [200 299]|select COUNT(*) as pv,status group by status"

if __name__ == '__main__':
    print("ready to create savedsearch")

    # The configurations of the saved search in JSON format. Define the saved search name, query statement, and destination Logstore.
    my_json_query_str = {
        "savedsearchName": savedsearch_name,
        "searchQuery": query,
        "logstore": logstore_name,
        "topic": "",
        "displayName": ""
    }
    # Call the API operation to create the saved search.
    client.create_savedsearch(project_name, detail=my_json_query_str)
    print("create savedsearch success")

Expected result:

ready to create savedsearch
create savedsearch success

Modify a saved search

Modify the saved search named ali-test-savedsearch:

from aliyun.log import LogClient
import os

# This example obtains the AccessKey ID and AccessKey secret from environment variables.
accessKeyId = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID', '')
accessKey = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET', '')
# The endpoint of Simple Log Service. This example uses the endpoint of the China (Hangzhou) region. Replace it with the actual endpoint.
endpoint = "cn-hangzhou.log.aliyuncs.com"
# Create a Simple Log Service client.
client = LogClient(endpoint, accessKeyId, accessKey)

# The project name.
project_name = "ali-test-project"
# The Logstore name.
logstore_name = "ali-test-logstore"
# The saved search name.
savedsearch_name = "ali-test-savedsearch"

# Query logs for failed GET or POST requests.
query = "(request_method:GET or request_method:POST) not status in [200 299]"

if __name__ == '__main__':
    print("ready to update savedsearch")

    print("Before update, the savedsearch is:")
    res = client.get_savedsearch(project_name, savedsearch_name)
    print(res.get_body())

    # The configurations of the saved search in JSON format. In this example, the query is modified to query logs for failed GET or POST requests.
    my_json_query_str = {
        "savedsearchName": savedsearch_name,
        "searchQuery": query,
        "logstore": logstore_name,
        "topic": "",
        "displayName": ""
    }
    # Call the API operation to modify the saved search.
    client.update_savedsearch(project_name, detail=my_json_query_str)

    print("After update, the savedsearch is:")
    res = client.get_savedsearch(project_name, savedsearch_name)
    print(res.get_body())

    print("update savedsearch success")

Expected result:

ready to update savedsearch
Before update, the savedsearch is:
{'displayName': '', 'logstore': 'ali-test-logstore', 'savedsearchName': 'ali-test-savedsearch', 'searchQuery': "*|select date_format(__time__-__time__%60, '%H:%i:%s') as time, COUNT(*) as pv group by time", 'topic': ''}
After update, the savedsearch is:
{'displayName': '', 'logstore': 'ali-test-logstore', 'savedsearchName': 'ali-test-savedsearch', 'searchQuery': '(request_method:GET or request_method:POST) not status in [200 299]', 'topic': ''}
update savedsearch success

List all saved searches

List all saved searches in a project:

from aliyun.log import LogClient
import os

# This example obtains the AccessKey ID and AccessKey secret from environment variables.
accessKeyId = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID', '')
accessKey = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET', '')
# The endpoint of Simple Log Service. This example uses the endpoint of the China (Hangzhou) region. Replace it with the actual endpoint.
endpoint = "cn-hangzhou.log.aliyuncs.com"
# Create a Simple Log Service client.
client = LogClient(endpoint, accessKeyId, accessKey)

# The project name.
project_name = "ali-test-project"

if __name__ == '__main__':
    print("ready to list savedsearch")
    # Query all saved searches.
    res = client.list_savedsearch(project_name, 0 ,100)
    print(res.get_entities())

    print("list savedsearch success")

Expected result:

ready to list savedsearch
['ali-test-savedsearch', 'testali-test-savedsearch2', 'ali-test-savedsearch2']
update savedsearch success

Get a saved search

Get a saved search by name:

from aliyun.log import LogClient
import os

# This example obtains the AccessKey ID and AccessKey secret from environment variables.
accessKeyId = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID', '')
accessKey = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET', '')
# The endpoint of Simple Log Service. This example uses the endpoint of the China (Hangzhou) region. Replace it with the actual endpoint.
endpoint = "cn-hangzhou.log.aliyuncs.com"
# Create a Simple Log Service client.
client = LogClient(endpoint, accessKeyId, accessKey)

# The project name.
project_name = "ali-test-project"

# The saved search name.
savedsearch_name = "ali-test-savedsearch"

if __name__ == '__main__':
    print("ready to get savedsearch")
    # Query the specified saved search.
    res = client.get_savedsearch(project_name, savedsearch_name)
    print(res.get_body())

    print("get savedsearch success")

Expected result:

ready to get savedsearch
{'displayName': 'ali-test-savedsearch', 'logstore': 'ali-test-logstore', 'savedsearchName': 'ali-test-savedsearch', 'searchQuery': '(request_method:GET or request_method:POST) not status in [200 299]', 'topic': ''}
get savedsearch success

Delete a saved search

Delete a saved search from a project:

from aliyun.log import LogClient
import os

# This example obtains the AccessKey ID and AccessKey secret from environment variables.
accessKeyId = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_ID', '')
accessKey = os.environ.get('ALIBABA_CLOUD_ACCESS_KEY_SECRET', '')
# The endpoint of Simple Log Service. This example uses the endpoint of the China (Hangzhou) region. Replace it with the actual endpoint.
endpoint = "cn-hangzhou.log.aliyuncs.com"
# Create a Simple Log Service client.
client = LogClient(endpoint, accessKeyId, accessKey)

# The project name.
project_name = "ali-test-project"

# The saved search name.
savedsearch_name = "ali-test-savedsearch"

if __name__ == '__main__':
    print("ready to delete savedsearch")

    print("Before delete, the savedsearch is:")
    res = client.list_savedsearch(project_name, 0, 100)
    print(res.get_entities())

    # Call the API operation to delete the saved search.
    client.delete_savedsearch(project_name, savedsearch_name)

    print("After delete, the savedsearch is:")
    res = client.list_savedsearch(project_name, 0, 100)
    print(res.get_entities())

    print("delete savedsearch success")

Expected result:

ready to delete savedsearch
Before delete, the savedsearch is:
['ali-test-savedsearch', 'testali-test-savedsearch2', 'ali-test-savedsearch2']
After delete, the savedsearch is:
['testali-test-savedsearch2', 'ali-test-savedsearch2']
delete savedsearch success

References

In addition to its native SDK, SLS also supports the common Alibaba Cloud SDKs. For more information, see Log Service_SDKcenter-Alibaba CloudOpenAPIDeveloper Portal.
Simple Log Service CLI.
Related API operations:
Alibaba Cloud Simple Log Service SDK for Python on GitHub.