Search and Analysis

Delay from log collection to search

Logs can be searched on the console within 2 minutes after being generated (congestion not considered).

N/A

Keywords

Keywords are conditions excluding Boolean logic operators during query. Up to 30 keywords are supported for a query.

To increase the upper limit, submit a service ticket.

Concurrent queries

Up to 200 concurrent queries are supported in a Huawei account.

To increase the upper limit, submit a service ticket.

Returned records

Up to 250 records are returned by default for a query on the console.

N/A

Returned records

Up to 5000 records are returned by default for an API query.

N/A

Field size

The maximum size of a field value is 2 KB. The excess part will not be used for quick analysis but can be queried by keyword.

N/A

Search result sorting

By default, search results are displayed by time (accurate to the second) in descending order.

N/A

Fuzzy search

• Each word in a query statement must be fewer than 255 characters.

• Words cannot start with an asterisk (*) or a question mark (?).
• Long and double data does not support fuzzy search using asterisks (*) or question marks (?).

N/A

Time range

By default, the time span for a single search cannot exceed 30 days.

To increase the upper limit, submit a service ticket.

Concurrent analysis tasks

Up to 15 concurrent log analysis tasks are supported in a Huawei account.

To increase the upper limit, submit a service ticket.

Data volume

Up to 24 GB of data can be analyzed at a time in a single log stream.

If your data volume is far beyond the analysis specifications provided by LTS, purchase DWS, configure log transfer to DWS, and use a data warehouse for analysis.

Status

By default, log analysis is disabled.

N/A

Log structuring

Log structuring rules take effect only for data written after the rules are created.

N/A

Returned records

Up to 100 records are returned by default.

To increase the number of returned records, use the SQL Syntax.

N/A

Up to 5000 records are returned for a LIMIT statement.

N/A

Field size

The maximum size of a structured field value is 16 KB. The excess part is not analyzed.

N/A

Timeout

Max. 30s.

If your data volume is far beyond the analysis specifications provided by LTS, purchase DWS, configure log transfer to DWS, and use a data warehouse for analysis.

Double value digits

Max. 52 characters.

Floating-point numbers with more than 52 bits are less precise than those with fewer bits.

N/A

IP address function

The IP address function analyzes the country, state/province, city, and network operator to which an IP address belongs. The backend database on which this function depends is updated every half year. Therefore, the mappings between a few IP addresses and geographical locations may not be updated in a timely manner.

N/A

SQL analysis time range

Only data generated in the last 30 days can be analyzed using SQL statements.

To increase the upper limit, submit a service ticket.