What is Simple Log Service?

Simple Log Service (SLS) is a cloud-native, low-cost platform that collects, processes, stores, queries, analyzes, monitors, and integrates logs, metrics, and traces at scale in real time. It powers observability, DevOps, security auditing, and business analytics.

Use cases

Log management

Provides comprehensive data collection capabilities from clients, servers, and cloud products.
Supports tiered storage for data with different lifecycles.
Supports petabyte-scale query and analysis daily to rapidly respond to business needs.

Unified data pipeline/data lake

Supports dozens of collection methods for unified, real-time ingestion of massive amounts of data.
Enables data cleansing, real-time consumption, and distribution for business analytics, big data analytics, and more.
Supports petabyte-scale query and analysis daily to rapidly respond to business needs.

Log security and compliance auditing

Builds a unified log security audit solution with data collection across multiple accounts and regions.
Automatically collects logs from new instances and centralizes storage to support auditing functions.
Includes built-in audit rules and integrates with third-party SIEM systems.

End-to-end observability and operations

Supports unified storage and correlated analysis of observability data like logs, metrics, and traces.
Integrates AIOps for intelligent inspection, prediction, anomaly detection, root cause analysis, and automated alerting.

Business analysis and monitoring

Connects system and business data to deliver real-time insights.
Helps prevent system risks and adjust business strategies. Unlike the T+1 latency of traditional BI systems, it provides real-time or minute-level data analysis.

Why choose Simple Log Service?

Compared to self-managed solutions like ELK, SLS offers these advantages:

Unified ingestion: Supports multiple data types, including logs, metrics, and traces, from clients, servers, IoT devices, mobile apps, cloud products, open-source systems, multi-cloud environments, and on-premises servers.
Efficient processing: Real-time data processing during collection, at write time, and after writing, with built-in functions and a stream processing engine.
Unified storage: Breaks down data silos and supports tiered storage with automated lifecycle management.
Intelligent analysis: Queries tens of billions of data records in seconds. It provides nearly 100 built-in analysis functions, supports local Agent Skill for intelligent log query and analysis, and features an AI assistant (Copilot) that automatically generates query statements.
End-to-end observability: Unified storage and correlated analysis for logs, metrics, and traces with AIOps-driven anomaly detection and root cause analysis.
Cost-effective: Uses a pay-as-you-go model that can reduce TCO by over 50%. Elastic scaling handles petabytes daily and absorbs traffic spikes.
Out-of-the-box: Built-in enterprise apps including CloudLens (observability) and FinOps (cost analysis). Compatible with various open-source engines.

Core features

Data collection

Multi-source ingestion: Supports client logs (web, app, IoT), server and application logs, Alibaba Cloud product logs (such as RDS, SLB, and OSS), standard protocols (such as Syslog, SNMP, and HTTP), and open-source system logs (such as Nginx, MySQL, and Kafka). It connects data across accounts, clouds, and hybrid environments.
Multiple collection methods: Supports the self-developed LoongCollector (an upgraded version of Logtail), WebTracking for front-end collection, SDKs, and APIs.
High reliability: Resumable uploads, elastic scaling, and multi-path transmission (public network, internal network, Global Accelerator). Automatically discovers new instances and collects their logs.

Data processing

SLS processes data in real time during data collection, at write time, and after writing. Operations include structuring, cleansing, filtering, formatting, masking, encrypting, routing, and enriching. Built-in functions cover text processing, JSON parsing, regex extraction, field mapping, and data conversion. A high-throughput, low-latency stream processing engine supports SPL statements.

Data storage

SLS stores data with redundancy for durability and availability while optimizing costs through intelligent tiering.

Unified storage platform: Breaks down data silos by supporting unified storage for logs, metrics, and traces.
Intelligent lifecycle management: For hot data, it supports high-frequency access with millisecond response times. For cold data, it provides infrequent access and automatically transitions to Infrequent Access or Archive storage to reduce storage costs.
High availability and durability: Multi-replica redundant storage ensures no data is lost. Storage types include Standard and Query.

Query and analysis

High-performance query engine: Supports Index-based query (responds to queries on tens of billions of data records in seconds) and Scan-based query and analysis (Scan) (for lightweight analysis). It includes nearly 100 built-in query and analysis functions (statistical, aggregate, string, time, etc.). It also supports cross-Store federated queries (StoreView) and high-precision analysis with Dedicated SQL.
Smart generation: Supports AI-powered generation of query and analysis statements (Copilot).
Intelligent operations capabilities: Integrates AIOps to provide anomaly detection, root cause analysis, and intelligent inspection capabilities. Supports scheduled SQL queries for report generation.
Compatibility with multiple products: Supports federated queries with external data sources, allowing you to use data from MySQL, PostgreSQL, OSS, and CSV files as external storage for query and analysis. It can also connect to third-party tools like Elasticsearch and Azure for query and analysis.

Data monitoring (visualization and alerting)

Visualization: Provides the dashboard feature with over 10 built-in chart types (tables, line charts, bar charts, maps, etc.). It also supports custom dashboards, console embedding, and drill-down analysis. It can be integrated with third-party systems like Grafana and Quick BI.
Intelligent alerting: One-stop solution covering alert monitoring, management, and notification. Supports unified alerting across sources, accounts, and conditions. Intelligent noise reduction eliminates alert storms. Notification channels include phone, SMS, DingTalk, WeChat, Lark, and webhooks.

Data output and integration

SLS supports downloading logs to a local machine or shipping logs to other cloud products. You can also use the SLS platform for real-time data consumption.

Data consumption: Supports real-time consumption via Spark Streaming, Flume, and Flink.
Data shipping: Supports real-time shipping to cloud products such as OSS, MaxCompute, and TSDB.

Get started

Get started with SLS in three stages. Each stage lists basic steps for all users and optional advanced steps.

	Preparation	Data ingestion	Data application
Core goal	Understand core concepts and complete basic setup to prepare for data ingestion.	Securely and efficiently transfer various types of data, such as logs, metrics, and traces, into Simple Log Service.	Leverage your data for business value through query, analysis, monitoring, and alerting.
Basic steps	Activate Simple Log Service. Understand core resources: Project and Store. Create a Project.	Familiarize yourself with data collection methods and understand the scope of data collection. Create a Store based on the data model: LogStore, MetricStore, EventStore. Choose a collection method to ingest data: Log collection, Metric collection, Trace collection, Event collection.	Query and analysis Index-based query: Perform fast queries and analysis with responses in milliseconds. Scan-based query and analysis (Scan): Perform a full scan and analysis of raw data. AI assistance: Use `Copilot` to intelligently generate query and analysis statements. Monitoring and visualization Dashboard: Visualize your data using dashboards. Alert: Set alert rules and policies.
Optional/advanced steps	Experience Simple Log Service with the Quick start: Collect text logs from an ECS instance tutorial. Resource planning: Plan your resource hierarchy and lifecycle in advance. Understand basic resource limits and resource throttling policies. Permission management: Configure RAM permissions for access control or restrict access by IP address.	Understand data storage methods and configure a storage policy with intelligent storage tiering. SLS provides different data processors for various stages, including during data collection, at write time, and after writing. Choose a processor based on the differences between data processors to configure data processing rules (such as masking, filtering, and enrichment).	Query and analysis StoreView: Supports correlated queries across Projects and Stores. Scheduled SQL query: Schedule SQL execution to generate reports. Dedicated SQL: Perform high-precision analysis on large volumes of data. Query with external data sources: Connect to external data sources as external storage for query and analysis. Monitoring and visualization Add a filter: Modify the data displayed on a dashboard by adding filter conditions. Alert Center dashboard: By default, SLS records alert information in a LogStore named internal-alert-center-log. You can perform custom analysis of alert logs. Integrate with Function Compute for automated alert handling: Supports integration with Function Compute to receive alert notifications and automatically handle alert events. Output and integration Download logs or ship data to external systems. Enable real-time data consumption.

Billing

Billing methods

Pay-as-you-go: Suitable for scenarios where business volume changes frequently.
Resource plan: Suitable for scenarios with relatively stable business volume.

Billing modes and billable items

Billable items for the pay-by-feature mode: Fine-grained billing. Each feature is charged independently, which is ideal for scenarios where feature usage is well-defined and costs need to be controlled precisely.
Billable items for the pay-by-ingested-data mode: Simplified billing. The core fee is based on the volume of ingested raw data, which is ideal for scenarios with frequent queries and analysis where a simple cost model is preferred.

FAQ

Data usage policy

Alibaba Cloud does not use or disclose your business data without your authorization, except as required to perform your service requests or as required by laws and regulations. Review the Service Terms.

Internal usage at Alibaba Cloud

Yes. Simple Log Service is the internal logging and monitoring platform for Alibaba, proven at scale during multiple Double 11 global shopping festivals. Developers within Alibaba Cloud also use Simple Log Service in many projects.

Service stability during data surges

SLS elastically scales to handle petabytes of data per day, absorbing traffic spikes and ensuring service stability.

Cost planning

The usage cost of Simple Log Service primarily consists of read/write and storage fees.

Read/write: Plan based on the number of shards, the data volume per read/write operation, and index usage.
Storage: Plan based on the retention period and storage type.

For more information, see Cost optimization.

Disabling the service and stopping billing

To stop billing, address both data collection and resource storage:

Stop log collection: After collection is stopped, the collector no longer transmits new logs.
Clean up storage resources: Delete the corresponding Project and LogStore in Simple Log Service. Ensure all associated resources are deleted to avoid charges for storage space usage.

For more information, see Stop billing.

Data retention period

You can store data permanently or for a specified period. Data that exceeds the specified retention period is automatically deleted. You can also enable intelligent storage tiering to transition data older than a specified period to Infrequent Access or Archive storage to reduce storage costs.