On-demand Cross-Logstore Query and Analysis

Step 1: Grant query permissions

Ensure that the RAM user or RAM role running the query has read permissions for all LogStores you intend to query. The query fails if read permissions are missing for even one LogStore.

To learn how to grant permissions to a RAM user or RAM role, see Create and authorize a RAM user or Create a RAM role for a trusted Alibaba Cloud service and grant permissions. You can grant permissions in one of the following ways:

• (Recommended) Grant a custom policy: Create a custom policy that grants read permissions for only the target LogStores. The following sample provides the core permissions required. Replace ${projectName} and ${logstoreName} with your Project name and the names of the LogStores to query.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "log:ListProject"
        ],
        "Resource": "acs:log:*:*:project/*"
      },
      {
        "Effect": "Allow",
        "Action": "log:GetProject",
        "Resource": "acs:log:*:*:project/${projectName}"
      },
      {
        "Effect": "Allow",
        "Action": "log:ListLogStores",
        "Resource": "acs:log:*:*:project/${projectName}/logstore/*"
      },
      {
        "Effect": "Allow",
        "Action": [
          "log:GetLogStore",
          "log:GetLogStoreHistogram",
          "log:GetIndex",
          "log:GetLogStoreLogs"
        ],
        "Resource": [
          "acs:log:*:*:project/${projectName}/logstore/${logstoreName}",
          "acs:log:*:*:project/${projectName}/logstore/${logstoreName}"
        ]
      }
    ]
  }

• Grant a system policy: Grant the AliyunLogReadOnlyAccess system policy. This method is simpler but grants broad read-only permissions to all resources in Log Service.

Step 2: Go to the query page

In the Log Service console, go to the Multi-store Query and Analysis page.

1. Log on to the Log Service console.

2. In the Projects, click the target Project Name.

3. In the left-side navigation pane, choose Log Storage (). In the Logstore list, click any LogStore to go to the Query Page.

4. On the Query Page, click Multi-store Query and Analysis.

Step 3: Select the LogStores to query

Select the LogStores to query.

1. Click Add.

2. In the Add Store dialog box, move the LogStores to query (up to 50) from the Source LogStore list to the Applied LogStore list.

3. Click Confirm Add.

Step 4: Run the query

Write a query and analysis statement to run against the selected LogStores. In the search box on the Search / Analysis tab, enter the statement and click Search / Analysis.

* | SELECT __logstore__, count(*) AS pv GROUP BY __logstore__

Step 5 (Optional): Save As Data View

If you frequently query the same combination of LogStores, save it as a StoreView for reuse.

1. Add Data View permissions to the policy configured in Step 1: Grant query permissions. The required statement is as follows:

       {
         "Effect": "Allow",
         "Action": [
           "log:ListStoreViews",
           "log:CreateStoreView",
           "log:GetStoreViewIndex",
           "log:GetStoreView"
         ],
         "Resource": "acs:log:*:*:/project/${projectName}/storeview/*"
         }

2. Click Save As Data View.

3. In the dialog box that appears, enter a StoreView Name.

4. Click OK.