Simple Log Service queries billions of log entries in seconds and supports SQL-based analytics. This guide uses Nginx logs to show how to configure indexes and run basic queries.
Prerequisites
You have created a project and a standard Logstore with data collection configured. Manage Projects, Create a Logstore, Data collection overview.
Step 1: Configure indexes
-
Log on to the Simple Log Service console.
-
In the Projects section, click the project you want.
-
On the tab, click the logstore you want.
-
On the Query & Analysis page of the Logstore, click Enable Index.
NoteData becomes queryable about one minute after indexing is enabled.
-
Clicking Enable Index enables the full-text index by default. On the Query and Analysis page, click Automatic Index Generation to auto-generate field indexes from the first log entry in the data preview.
NoteLeave other parameters at their default values. Create indexes.
Generated field index configuration:
Step 2: Query and analyze logs
-
SLS Query Skill for intelligent log query and analysis: Use natural language to query and analyze log data in a local AI agent.
-
Generate query and analytic statements with AI (Copilot): Generate SQL from natural language, explain complex SQL, and optimize SQL statements.
In the search box on the Search & Analyze page, enter a search or analytic statement and click Search & Analyze.
-
Search statements
Search statements filter log data by time range, request type, keyword, or other conditions. They can be used alone. Query syntax and functions.
Example: Query logs with status code
200:status:200 -
Analytic statements
Analytic statements aggregate, transform, and filter log data, computing metrics such as time-series averages or year-over-year and month-over-month comparisons. An analytic statement must follow a search statement in the
search statement | analytic statementformat. SQL analysis syntax and functions.Example: Count requests by status code:
* | SELECT status, count(*) AS PV GROUP BY status
By default, clicking a Logstore in the Logstore list opens the Search & Analyze page and runs a query automatically. To change this behavior, click the 
icon in the upper-right corner and use the Query Settings tab.
Configure a time range
Set the time range for Search & Analyze using one of the following methods. Time ranges specified in analytic statements override the time picker.
-
In the time range picker at the top of the page, select a time range, such as 15 Minutes.
-
In an analytic statement, use the
__time__field to specify a time range. Example:* | SELECT * FROM log WHERE __time__ > 1731297600 AND __time__ < 1731310038 -
In an analytic statement, use the from_unixtime function or to_unixtime function to convert time formats. Examples:
* | SELECT * FROM log WHERE from_unixtime(__time__) > from_unixtime(1731297600) AND from_unixtime(__time__) < now()* | SELECT * FROM log WHERE __time__ > to_unixtime(date_parse('2024-10-19 15:46:05', '%Y-%m-%d %H:%i:%s')) AND __time__ < to_unixtime(now())
By default, a query returns a maximum of 100 rows. To return more data, use the LIMIT clause.
Query & Analysis page
Page overview
Histogram
-
Hover over a green block to view its time range and hit count.
-
Double-click a green block to drill into a finer time granularity. Results for that time range appear on the Raw Logs tab.
Raw logs
-
Log details
-
Click Table or Raw Data to switch the log display format.
-
> Download Log: Download logs to your computer. Download logs.
-
> JSON Settings: Set the display type and level for JSON logs.
-
> Event Settings: Configure events for raw logs.
-
: Copy the log content.
-
: Use SLS Copilot to summarize information and find errors based on log content.
-
: View a log entry in context within its original file. Available only for Logtail-collected logs. Contextual query.
-
: Monitor logs in real time and extract key information. Available only for Logtail-collected logs. LiveTail.
-
-
Displayed fields
-
In the Displayed Fields section, click the
icon next to a field to remove it from Displayed Fields. The field no longer appears in logs on the right. -
: Save the current field selection to favorites. After you specify the fields to display in Area 5, select a saved view from the drop-down list above Area 4.
-
> Tag Settings: Set a field as a system tag.
-
> Alias: If you enable this feature, field names are replaced by their aliases. Fields without aliases keep their original names. Set field aliases in Create indexes.
-
-
Index fields
-
In the Indexed Fields section, click the
icon next to a field to add it to Displayed Fields. The field then appears in logs on the right. -
: View the Basic Distribution and Statistical Metrics of the field. Field settings.
-
> Download Log
> JSON Settings: Set the display type and level for JSON logs. 
: Copy the log content.
: Use SLS Copilot to summarize information and find errors based on log content.
: View a log entry in context within its original file. Available only for Logtail-collected logs. 
: Monitor logs in real time and extract key information. Available only for Logtail-collected logs. 
icon next to a field to remove it from Displayed Fields. The field no longer appears in logs on the right.
: Save the current field selection to favorites. After you specify the fields to display in Area 5, select a saved view from the drop-down list above Area 4.
> Tag Settings: Set a field as a system tag.
icon next to a field to add it to Displayed Fields. The field then appears in logs on the right.
: View the Basic Distribution and Statistical Metrics of the field. Graph
A graph renders the visual output of a query and analytic statement. Simple Log Service supports tables, line charts, column charts, and more. Statistical charts. View results on the Graph tab. 
Other features on this tab:
-
Add to New Dashboard: Save query and analysis results as a chart to a dashboard for real-time monitoring. Click Add to New Dashboard to add a chart. Visualization overview.
-
Save as Scheduled SQL Job: Periodically analyze data, store aggregated results, and project or filter data. Scheduled SQL.
-
Interaction Occurrences: Drill down into data by adjusting dimension hierarchy and analysis granularity. Add an interaction to a dashboard for drill-down analysis.
LogReduce
On the LogReduce tab, click Enable LogReduce to aggregate highly similar logs during collection. LogReduce.
SQL enhancement
Click the 
icon in the upper-right corner to enable Dedicated SQL for the current session. Dedicated SQL allocates additional computing resources for analyzing larger data volumes per query. To enable Dedicated SQL by default: High-performance, fully accurate query and analysis (Dedicated SQL).
Alerting
Click the 
icon in the upper-right corner and select Save as Alert to create an alert rule based on the query and analysis results. Get started with alerting.
Saved search
Click the 
icon in the upper-right corner to Save as Saved Search the current query and analysis statement. Use saved searches to quickly re-run frequent queries. Saved Search.
Share
Click the 
icon in the upper-right corner to copy and share the URL of the current page. Embed and share console pages.
Data transformation
Click Data Transformation in the upper-left corner to open the data transformation page. Transform data for normalization, extraction, cleansing, filtering, and distribution across multiple Logstores. Create a data transformation task (new version).