As a cloud-native data application platform, Simple Log Service (SLS) provides large-scale, low-cost, and real-time platform services for data such as logs, metrics, and traces. SLS offers one-stop capabilities for data collection, processing, storage, query and analysis, monitoring, and integration, enhancing digital capabilities across development, DevOps, business operations, and security scenarios.
Use cases
Log management
| Unified data pipeline/data lake
| Log security and compliance auditing
| End-to-end observability and operations
| Business analysis and monitoring
|
Why choose Simple Log Service?
SLS is more than just a logging system; it is a core component of an enterprise-grade unified data platform and intelligent operations platform. Compared to self-managed solutions like the ELK stack, SLS offers the following key advantages:
Unified ingestion: Supports multiple data types, including logs, metrics, and traces, from clients, servers, IoT devices, mobile apps, cloud products, open-source systems, multi-cloud environments, and on-premises servers.
Efficient processing: Provides real-time data processing capabilities at multiple stages: during collection, at write time, and after writing. It includes a rich set of built-in functions and a stream processing engine.
Unified storage: Breaks down data silos and supports tiered storage with automated lifecycle management.
Intelligent analysis: Queries tens of billions of data records in seconds. It provides nearly 100 built-in analysis functions, supports local Agent Skill for intelligent log query and analysis, and features an AI assistant (Copilot) that automatically generates query statements.
End-to-end observability: Provides unified storage and correlated analysis for logs, metrics, and traces. It integrates AIOps for intelligent anomaly detection and root cause analysis.
Cost-effective: Uses a pay-as-you-go model that can reduce TCO by over 50%. It also features elastic scaling to handle petabytes of data per day and manage traffic spikes.
Out-of-the-box: Includes built-in enterprise applications like CloudLens (observability) and FinOps (cost analysis). It supports an open ecosystem and is compatible with various open-source engines.
Core features
Data collection
Multi-source ingestion: Supports client logs (web, app, IoT), server and application logs, Alibaba Cloud product logs (such as RDS, SLB, and OSS), standard protocols (such as Syslog, SNMP, and HTTP), and open-source system logs (such as Nginx, MySQL, and Kafka). It connects data across accounts, clouds, and hybrid environments.
Multiple collection methods: Supports the self-developed LoongCollector (an upgraded version of Logtail), WebTracking for front-end collection, SDKs, and APIs.
High reliability: Ensures stability with features like resumable uploads, elastic scaling, and multi-path transmission (public network, internal network, and Global Accelerator). It automatically discovers new instances and collects their logs.
Data processing
SLS supports end-to-end data processing, with real-time processing available during data collection, at write time, and after writing. You can structure, cleanse, filter, format, mask, encrypt, route, and enrich data. SLS includes a variety of built-in functions for text processing, JSON parsing, regex extraction, field mapping, and data conversion. It features a high-throughput, low-latency stream processing engine and supports SPL processing statements.
Data storage
SLS offers an intelligent data storage solution that optimizes costs without compromising functionality. It uses redundancy to guarantee data durability and availability.
Unified storage platform: Breaks down data silos by supporting unified storage for logs, metrics, and traces.
Intelligent lifecycle management: For hot data, it supports high-frequency access with millisecond response times. For cold data, it provides infrequent access and automatically transitions to Infrequent Access or Archive storage to reduce storage costs.
High availability and durability: Multi-replica redundant storage ensures no data is lost. Storage types include Standard and Query.
Query and analysis
High-performance query engine: Supports Index-based query (responds to queries on tens of billions of data records in seconds) and Scan-based query and analysis (Scan) (for lightweight analysis). It includes nearly 100 built-in query and analysis functions (statistical, aggregate, string, time, etc.). It also supports cross-Store federated queries (StoreView) and high-precision analysis with Dedicated SQL.
Smart generation: Supports AI-powered generation of query and analysis statements (Copilot).
Intelligent operations capabilities: Integrates AIOps to provide anomaly detection, root cause analysis, and intelligent inspection capabilities. Supports scheduled SQL queries for report generation.
Compatibility with multiple products: Supports federated queries with external data sources, allowing you to use data from MySQL, PostgreSQL, OSS, and CSV files as external storage for query and analysis. It can also connect to third-party tools like Elasticsearch and Azure for query and analysis.
Data monitoring (visualization and alerting)
Visualization: Provides the dashboard feature with over 10 built-in chart types (tables, line charts, bar charts, maps, etc.). It also supports custom dashboards, console embedding, and drill-down analysis. It can be integrated with third-party systems like Grafana and Quick BI.
Intelligent alerting: Offers a one-stop alerting solution that includes alert monitoring, alert management, and notification (action) management. It supports unified alerting across multiple sources, accounts, and conditions. Automated intelligent noise reduction eliminates "alert storms." Notifications can be sent through multiple channels, including phone, SMS, DingTalk, WeChat, Lark, and webhooks.
Data output and integration
SLS supports downloading logs to a local machine or shipping logs to other cloud products. You can also use the SLS platform for real-time data consumption.
Data consumption: Supports real-time consumption via Spark Streaming, Flume, and Flink.
Data shipping: Supports real-time shipping to cloud products such as OSS, MaxCompute, and TSDB.
Get started
To help you use Simple Log Service quickly and efficiently, we recommend following these three core stages. Each stage includes basic steps (recommended for all users) and optional/advanced steps (for users who require more in-depth functionality).
Preparation | Data ingestion | Data application | |
Core goal | Understand core concepts and complete basic setup to prepare for data ingestion. | Securely and efficiently transfer various types of data, such as logs, metrics, and traces, into Simple Log Service. | Leverage your data for business value through query, analysis, monitoring, and alerting. |
Basic steps |
|
|
|
Optional/advanced steps |
|
|
|
Billing
Billing methods
Pay-as-you-go: Suitable for scenarios where business volume changes frequently.
Resource plan: Suitable for scenarios with relatively stable business volume.
Billing modes and billable items
Billable items for the pay-by-feature mode: Fine-grained billing. Each feature is charged independently, which is ideal for scenarios where feature usage is well-defined and costs need to be controlled precisely.
Billable items for the pay-by-ingested-data mode: Simplified billing. The core fee is based on the volume of ingested raw data, which is ideal for scenarios with frequent queries and analysis where a simple cost model is preferred.
FAQ
Data usage policy
Alibaba Cloud does not use or disclose your business data without your authorization, except as required to perform your service requests or as required by laws and regulations. For more information, see the Service Terms.
Internal usage at Alibaba Cloud
Yes. Simple Log Service is the internal logging and monitoring platform for Alibaba and has been proven at scale during multiple Double 11 global shopping festivals. Developers within Alibaba Cloud also use Simple Log Service in many projects.
Service stability during data surges
Simple Log Service provides a flexible and adaptive data infrastructure with elastic scaling capabilities that can handle petabytes of data per day. This ensures it can easily cope with traffic peaks and business growth.
Cost planning
The usage cost of Simple Log Service primarily consists of read/write and storage fees.
Read/write: Plan based on the number of shards, the data volume per read/write operation, and index usage.
Storage: Plan based on the retention period and storage type.
For details, see Cost optimization.
Disabling the service and stopping billing
To stop billing for Simple Log Service, you must address both data collection and resource storage:
Stop log collection: After collection is stopped, the collector no longer transmits new logs.
Clean up storage resources: Delete the corresponding Project and LogStore in Simple Log Service. Ensure all associated resources are deleted to avoid charges for storage space usage.
For details, see Stop billing.
Data retention period
You can store data permanently or for a specified period. Data that exceeds the specified retention period is automatically deleted. You can also enable intelligent storage tiering to transition data older than a specified period to Infrequent Access or Archive storage to reduce storage costs.