Manage Logstores

Console

1. Log on to the Simple Log Service console. In the Project list, click the target Project.

2. On the Log Storage > Logstores tab, click the + icon.

3. On the Create Logstore page, configure the settings and click OK.

   1. Logstore type: Standard by default.

   2. Billing mode:

      • Pay-by-feature: You are billed separately for each resource used (such as storage, indexing, and read/write operations) and receive a monthly free quota, which helps control costs in small-scale scenarios.

      • Pay-by-ingested-data: You pay only for the raw ingested data volume. Storage and core features are free for 30 days, offering a simpler and more cost-effective pricing model.

      Quick tip: The closer your retention period is to 30 days and the more fields you index (especially full-text indexing), the more suitable pay-by-ingested-data becomes.

   3. Logstore name: Must be unique within the Project and cannot be changed after creation.

   4. Data retention period: 30 days by default.

   5. Keep all other settings at their default values.

   Full Logstore parameter list (expandable)

   Parameter	Description
   Logstore type	SLS Logstores support Standard and Query types. Choose based on your scenario to optimize costs. Standard includes SLS’s full suite of analytics features, ideal for real-time monitoring, interactive analysis, and building observability systems. Query has an index traffic price that is 29% of Standard. For the same budget, Query lets you index more fields at lower cost. However, Query supports only keyword search and does not support statistical analysis.
   Billing mode	Pay-by-feature: The original SLS billing model. You pay for actual usage of resources (such as storage and indexing) and features (such as data transformation and data shipping) on a pay-as-you-go basis. Pay-by-ingested-data: A simplified SLS billing model that charges only for the raw ingested data volume. After ingestion, you get 30 days of free storage and free access to features like data transformation and data shipping. This model is simple, predictable, and cost-effective for deep SLS usage.
   Logstore name	The Logstore name must be globally unique within the Project and cannot be modified after creation.
   WebTracking	WebTracking enables quick collection of browser, iOS/Android app, and frontend access logs. Disabled by default.
   Data retention period	Retention duration in days. Valid values: 1–3650. Setting this to 3650 means permanent retention. Logs are deleted once they reach the configured retention period.
   Intelligent tiering	Automatically tiers data using lifecycle management. Hot storage: Hot storage is a scalable, highly available solution for frequently accessed data. It supports real-time access and delivers high-performance log query and analysis, ideal for frequent query and analysis scenarios. IA storage class IA storage class (formerly cold storage) reduces long-term storage costs while preserving full capabilities for querying, analysis, visualization, alerting, shipping, and transformation. It suits low-frequency query and analysis scenarios, such as issue backtracking. Archive Storage Archive Storage provides a lower-cost, queryable, and analyzable long-term storage option beyond hot and IA storage. It is ideal for long-term audit log retention.
   Number of shards	Each shard supports 5 MB/s of write throughput and 10 MB/s of read throughput. If data traffic exceeds a shard's capacity, you can split the shard. If data traffic falls below a shard's maximum read and write capacity, you can merge shards to save costs.
   Automatic sharding	If write traffic exceeds the read/write capacity of existing shards for more than 5 minutes, enabling automatic sharding increases the number of shards based on data volume.
   Maximum shards	With automatic sharding enabled, up to 256 shards can be created automatically.
   Record public IP	After receiving logs, the system automatically adds the client’s public IP address and the log arrival time.

API

Create a Logstore

Console

In Basic Information, click Modify, adjust the data retention period, and click Save.

Simple Log Service supports deleting specific log entries by using the Log Soft Delete feature. On the Query and Analysis page of the LogStore, enter query conditions, select a time range, and click Log Soft Delete to submit a deletion task. Deleted log entries no longer appear in subsequent queries and are permanently deleted after the retention period ends. You can also delete expired logs in batches by changing the data retention period, or by stopping billing or deleting the LogStore to remove all logs.

API

Adjust the log retention period by updating the ttl value in Update Logstore.

Console

1. In Basic Information, click Modify and enable intelligent tiering.

2. Configure the Storage Policy: The sum of days across all three tiers must equal the total data retention period.

   • Hot storage: minimum 7 days.

   • IA storage class: minimum 30 days.

   • Archive Storage: minimum 60 days.

   Set Data retention period to Limited days, enable Intelligent tiering, and configure tier transitions in Storage policy: hot storage automatically transitions to IA storage after its period ends, IA storage transitions to Archive Storage, and Archive Storage is automatically deleted after its period ends.

3. Click Save. For details, see Intelligent tiering.

API

Dynamically adjust the retention policy for storage tiers by updating the ttl, hot_ttl, and infrequentAccessTTL values in Update Logstore.

Console

In Basic Properties, click Modify, enable WebTracking, and click Save.

API

Enable WebTracking by setting the enable_tracking parameter to true in Update Logstore.

Console

In Basic Properties, click Modify, enable Record public IP, and click Save.

API

Enable public IP recording by setting the appendMeta parameter in Update Logstore.

Console

In Basic Properties, click Modify, enable Automatic sharding, set the shard limit, and click Save.

Simple Log Service supports splitting and merging individual shards.

API

Split shard.

Merge shard.

Console

1. Clean up before deletion.

   1. Delete all associated Logtail configurations before deleting the LogStore. This is the only hard prerequisite check that the console performs when you delete a LogStore: if the LogStore is still associated with Logtail collection configurations, the console reports that Logtail configurations exist and must be deleted first, and the deletion cannot continue. Therefore, if a LogStore cannot be deleted, first delete all Logtail collection configurations of that LogStore, and then delete the LogStore again.

   2. If LogShipper is enabled for this Logstore, stop writing new data and confirm all existing data has been successfully shipped before deletion.

   3. In the Job Management section, review all tasks for the current Project and delete any tasks associated with this Logstore.

   4. Release Protection of a Project applies to the Project itself: after it is enabled, you must manually disable it before you can delete the Project. Deleting a single LogStore is not affected by this feature, so you do not need to disable it.

2. Deletion steps.

   1. On the Log Storage > Logstores tab, hover over the target Logstore and select Delete.

   2. In the Warning dialog box, click Confirm Deletion.

3. Post-deletion notes.

   1. Storage fees still apply on the day of deletion. No fees accrue from the next day onward. You will not receive a bill for this Logstore starting on the third day after deletion.

   2. After deletion, all export tasks, data transformation jobs, scheduled SQL tasks using this Logstore as a source, and import tasks targeting this Logstore are deleted.

API

Delete Logstore