Accessing the Log Search Page

Searching Logs

1. Log in to the LTS console. The Log Management page is displayed by default.
2. Click the target log group or stream. The log stream details page is displayed.
3. You can select a time range above the search box to view log data accordingly.
   There are three types of time range: relative time from now, relative time from last, and specified time. Select a time range as required.

   

   • From now: queries log data generated in a time range that ends with the current time, such as the previous 1, 5, or 15 minutes. For example, if the current time is 19:20:31 and 1 hour is selected as the relative time from now, the charts on the dashboard display the log data that is generated from 18:20:31 to 19:20:31.
   • From last: queries log data generated in a time range that ends with the current time, such as the previous 1 or 15 minutes. For example, if the current time is 19:20:31 and 1 hour is selected as the relative time from last, the charts on the dashboard display the log data that is generated from 18:00:00 to 19:00:00.
   • Specified: queries log data that is generated in a specified time range. The time range can be up to three months for common users and six months for whitelisted users. If necessary, submit a service ticket to extend the time range to six months.

4. Enter search criteria in the search box based on Using LTS Search Syntax to view, search for, and filter log data.
   • In the search area, click the search box, enter a keyword or select a field or keyword from the drop-down list, and click Search.
     

     • System reserved fields include appName, category, clusterId, clusterName, and collectTime. By default, the fields are displayed in simplified mode, and hostIP, hostName, and pathFile are displayed at the beginning. For more system reserved fields, see Setting Indexes.
     • The structured fields are displayed in key:value format.
     • If there is too much content in the log search box, the content can be automatically wrapped and displayed in multiple lines.
     • The height of the search box can be fixed.
   • In the search area, press the up and down arrows on the keyboard to select a keyword or search syntax from the drop-down list, press Tab or Enter to select a keyword or syntax, and click Search.
   • Click a field for which quick analysis has been enabled to add it to the search box. For details about how to enable quick analysis, see Creating an LTS Quick Analysis Task.
     

     If the field you click already exists in the search box, it will be replaced by this newly added one. If the field is added for the first time, fields in the search box are searched using the AND operator.

5. On the Log Search tab page, perform the following operations. For more operations, see Common Log Search Operations.
   1. Under Log Statistics, view the bar chart showing the log quantity in different time segments. The scale of the log quantity is displayed on the left.
      

      If the embedding function is used, you can collapse or expand the log quantity statistics chart. For parameters of embedding LTS, see LTS Address.

   2. In the log content area, hover the cursor over a field and click the log content in blue. You can search for logs by copying, adding to query, adding to query (interactive mode), creating query, excluding from query (interactive mode), hiding, and excluding from query.
   3. In the log list, click in front of the time to display structured fields in table or JSON format.
      • On the Table tab page, you can search for logs by adding a field to or excluding a field from a query, or by setting whether a field exists, whether a field does not exist, or whether a field is hidden. For details, see Using LTS Search Syntax.
      • On the JSON tab page, you can view and copy a log.
   4. In the log content area, you can select a list or raw log to display its log content.
      

      The log highlighting mechanism works as follows: Once a log meets the search criteria, the system identifies the log's strings that match these criteria and applies highlight tags to the matching sections, making them visibly highlighted on the page. However, when the query criteria are complex, particularly involving OR relationships, content that does not actually match the criteria may also be highlighted on the page.

6. Set the layout of log data, including whether to display fields or display fields in a simple view.
   1. Select Edit layouts from the drop-down list to access the layout setting page. The list also contains options such as the default layout, pure layout, and default container log layout, for you to set whether to display fields.
      • Cloud: This mode is applicable to users who have the write permission. Layout information is stored on the cloud.
      • Local Cache: This mode is applicable to users who have only the read permission. Layout information is cached in the local browser.
   2. Click to add a custom layout and set the layout name and visibility of layout fields.
   3. After the setting is complete, click OK. The new custom layout is displayed in the drop-down list.

Interactive Mode

Before using the interactive mode function, ensure that logs are properly reported and structured, and indexing have been configured. For details, see Setting Cloud Structuring Parsing and Setting Indexes.

Interactive search generates simple search statements, allowing you to set search criteria and specify query filter rules on the LTS console to filter log records. For more functions or nested queries, enter SQL statements manually. For details, see SQL Analysis Syntax.

1. Click Interaction Mode in front of the search box to access the interactive search page.
   Figure 1 Interactive Mode
   

2. Select the log search field and criteria from the drop-down list. The corresponding values of the field will be displayed in the search box. Add associations or groups to customize your search mode.
   • The drop-down list displays index fields, structured fields, and system reserved fields.
   • AND indicates that all conditions must be met.
   • OR indicates that only one of the conditions needs to be met.

   For example, you can select fields such as content, collectTime, and category and set different conditions. Then you can preview the search statement at any time and modify the search conditions with ease.

   (The following figure is for reference only.)

   (content:"{\"write_traffic\":11,\"index_traffic\":133,\"storage\":17107}" AND collectTime=1728631667089) OR category:LTS

   

3. After setting the parameters, click OK. LTS searches for logs based on your search statement and displays the search results on the Log Search tab page. (The following figure is for reference only.)

   

Common Log Search Operations

In the log content display area, you can share and download logs, and view context. For details, see Table 1.

Table 1 Common operations

Operation	Description
Creating quick search	Click to create a quick search.
Viewing dashboards	Click to view the dashboards you created.
Adding alarm rules	Click and create an alarm rule on the displayed page.
Sharing logs	Click to copy the link of the current log search page to share the logs that you have searched.
Refreshing logs	You can click to refresh logs in two modes: manual refresh and automatic refresh. Manual refresh: Select Refresh Now from the drop-down list. Automatic refresh: Select an interval from the drop-down list to automatically refresh logs. The interval can be 15 seconds, 30 seconds, 1 minute, or 5 minutes.
Copying logs	Click to copy the log content.
Viewing context of a log	Click to view the log context. NOTE: You can select Simple View to view the log context. You can also download the context.
More operations	Click to access the log details page of the time segment and view more log information. On the Extended Fields tab page, view field names and values. You can also click buttons in the Operation column to add a field to or exclude a field from a query, set whether a field exists or does not exist, or set whether a field is hidden. On the JSON Format tab page, view the JSON format of logs. On the Context Logs tab page, you can set the number of lines to be queried and filtered fields. You can also download logs and enable the summary mode.
Unfold/Fold	Click to display all the log content. Click to fold the log content. NOTE: Unfold is enabled by default.
Downloading logs	This function is available only to whitelisted users. To enable it, submit a service ticket. Click . On the displayed page, click Direct Download or Transfer and Download (this option is available only after one-off transfer is enabled). Direct Download: Download log files to the local PC. Up to 20 million logs can be downloaded at a time for a whitelisted user. A non-whitelisted user can download up to 5,000 logs at a time. Select .csv or .txt from the drop-down list and click Download to export logs to the local PC. Transfer and Download (available only to whitelisted users): Download log files through OBS transfer tasks. Up to 20 million logs can be downloaded at a time. Click Transfer to access the Configure Log Transfer page. For details, see Transferring Logs to OBS. Hover your cursor over and click View Download History. On the displayed page, view, download, and delete log download records.
Collapse all/Expand all	Click to set the number of lines displayed in the log content. Click to close it. NOTE: By default, logs are not collapsed, and two rows of logs are shown after collapsing. You can display up to six rows.
JSON	Move the cursor over , click JSON, and set JSON formatting. NOTE: Formatting is enabled by default. The default number of expanded levels is 2. If a log contains multiple backslashes, the first backslash will be lost when the log is displayed in JSON format because it will be processed as an escape character during JSON parsing. Formatting enabled: Set the default number of expanded levels. Maximum value: 10. Formatting disabled: JSON logs will not be formatted for display.
Collapse configuration	Move the cursor over , click Log Collapse, and set the maximum characters to display in a log. If the number of characters in a log exceeds the maximum, the extra characters will be hidden. Click Expand to view all. NOTE: Logs are collapsed by default, with a default character limit of 400.
Log time display	Move the cursor over and click Log time display. On the page that is displayed, set whether to display milliseconds and whether to display the time zone. NOTE: By default, the function of displaying milliseconds is enabled.
Virtual Scrolling	Move the cursor over and click Virtual Scrolling. On the page that is displayed, set whether to enable virtual scrolling and enter the buffer size. NOTE: Virtual scrolling eliminates or minimizes frame and page freezing for better user experience. Data is re-rendered during the process. This may affect smoothness. The buffer size determines the amount of data that can be loaded simultaneously. The larger the buffer, the more data loaded simultaneously, but the worse the scrolling performance.
Invisible fields ()	This list displays the invisible fields configured in the layout settings. The button is unavailable for log streams without layout settings configured. If the log content is CONFIG_FILE and layout settings are not configured, the default invisible fields include appName, clusterId, clusterName, containerName, hostIPv6, NameSpace, podName, and serviceID.

Cross-stream Search (Available to Whitelisted Users)

Currently, this function is available only to whitelisted users. To enable it, submit a service ticket.

On the log stream details page, you can search for logs across log streams. This meas you can search for logs in other log streams without exiting the current log search page.

1. On the log stream details page, click .

   

2. On the displayed page, select one or more target log streams.

   

3. Click OK.
4. On the target log stream details page displayed, search for logs by referring to Using LTS Search Syntax.

   To change the log stream, click next to Cross-Stream Search in the upper left corner and select another log stream.

   

5. After the search is complete, click Exit in the upper right corner to return to the current log stream search page.
   

   • If the target log streams for cross-stream search use different delimiters, the log keywords in different streams will be highlighted differently.
   • Up to 50 log streams can be searched at a time.
   • Only raw logs can be searched. SQL statements cannot be used for statistical analysis.
   • You can select log streams across log groups, but not across regions.
   • If you select multiple log streams with different index configurations for cross-stream search, for example, indexing Key1 in stream A but not in stream B, searches for Key1:xxx will only return logs from stream A. Address the issue according to the error message and retry the log search.