Help Center> Log Tank Service> User Guide> Log Search and Analysis> Search Syntax and Functions> Quick Analysis
Updated on 2024-04-19 GMT+08:00
View PDF

Quick Analysis

Monitoring keywords in logs helps you keep track of system performance and services. For example, the number of ERROR keywords indicates the system health, and the number of BUY keywords indicates the sales volume. LTS provides quick analysis for you to obtain statistics on your specified keywords.

  • Supports analysis on first 100,000 logs.

    The purpose of quick analysis is to quickly return the distribution and change trend of field values. It does not analyze all data, but only samples.

  • Logs can be filtered by query time and criteria for analysis.

    Quick analysis is to analyze the logs queried by query statements. When the number of queried logs is 0, no result is displayed for quick analysis.

  • Quick analysis can be used to generate query statements.

    You can click an analysis result to automatically generate a query statement, query logs, and generate a new quick analysis.

  • The maximum length of a field for quick analysis is 2000 bytes.
  • The distribution statistics in quick analysis field area displays the first 100 records.
  • If a structured field did not occur in logs during the specified time range, its occurrence percentage will be displayed as null.

Prerequisites

Quick analysis is conducted on fields extracted from structured logs. Structure raw logs before you create a quick analysis task.

Creating a Quick Analysis Task

You can enable Quick Analysis for the fields on the Log Structuring page. You can also perform the following steps to create a quick analysis task:

  1. Log in to the LTS console. In the navigation pane on the left, choose Log Management.
  2. A quick analysis is performed on a log stream. Select the target log group and log stream on the Log Management page.
  3. You can create a quick analysis task in either of the following ways:

    1. Click to go to the setting details page. Under Index Fields, enable Quick Analysis when adding a field.
    2. On the Cloud Structuring Parsing tab page, enable Auto Configuration and Analysis. It is enabled by default. This enables structured fields for configuring indexes and quick analysis.

  4. On the Raw Logs tab page, click Set Quick Analysis. On the displayed Index Settings tab page, add fields for quick analysis.
  5. Click OK. The quick analysis task is created.

    Figure 1 Viewing quick analysis results
    • indicates a field of the string type.
    • indicates a field of the float type.
    • indicates a field of the long type.
    • The maximum length of a field for quick analysis is 2000 bytes.
    • The quick analysis field area displays the first 100 records.
    • Click to view the chart generated. For fields of the string type, the field distribution and intelligent aggregation timeline can be displayed. For fields of the long and float type, only the intelligent aggregation timeline can be displayed. Click the chart to view details.
    • Click the field distribution or intelligent aggregation time line, the visualization page is displayed and the corresponding SQL query statement is generated. In this way, the distribution and change trend of field values are displayed more intuitively. For details, see Visualization.

Secondary Analysis

The quick analysis supports secondary analysis of float and long fields.

Click Max, Min, Avg, and Sum under the target field to quickly collect the maximum, minimum, average, and sum values.