Log Search

Follow the directions below to search logs by keyword and time range:

On the LTS console, choose Log Management in the navigation pane on the left.
In the log group list, click on the left of a log group name.
In the log stream list, click a log stream name.
In the upper right corner, select a time range.
There are three types of time range: relative time from now, relative time from last, and specified time. Select a time range as required.
- From now: queries log data generated in a time range that ends with the current time, such as the previous 1, 5, or 15 minutes. For example, if the current time is 19:20:31 and 1 hour is selected as the relative time from now, the charts on the dashboard display the log data that is generated from 18:20:31 to 19:20:31.
- From last: queries log data generated in a time range that ends with the current time, such as the previous 1 or 15 minutes. For example, if the current time is 19:20:31 and 1 hour is selected as the relative time from last, the charts on the dashboard display the log data that is generated from 18:00:00 to 19:00:00.
- Specified time: queries log data that is generated in a specified time range.
On the log stream details page, you can search for logs using the following methods:
1. In the search area, click in the search box. The drop-down list contains the following items:
  - Structured fields or index fields: Built-in fields are not displayed in the drop-down list. However, when you enter a built-in field, the drop-down list is automatically associated and matched with the field.
  - NOT, AND, OR, :, and :* keywords can be displayed. Keywords other than NOT are displayed in the drop-down list only after you enter the keyword in the search box.
    When entering a keyword, you can press Tab to automatically add the first keyword displayed in the drop-down list.
    
    Keywords are case-insensitive.
  - Historical records: A maximum of 20 historical records can be retained, but only the latest three records are displayed in the drop-down list.
  - Quick search: quick search fields that have been created.
  - Search syntax: common search syntax.
  Enter a keyword, or select a field and keyword from the drop-down list, and click Query.
  
  Logs that contain the keyword are displayed.
  - Built-in fields include appName, category, clusterId, clusterName, collectTime, containerName, hostIP, hostIPv6, hostId, hostName, nameSpace, pathFile, podName and serviceID. By default, the fields are displayed in simplified mode, and hostIP, hostName, and pathFile are displayed at the beginning.
  - The structured fields are displayed in key:value format.
2. On the Raw Logs page, click a field in blue in the log content. You can select Copy, Add To Search, and Exclude from Search from the displayed drop-down list.
3. Click a field for which quick analysis has been created to add it to the search box.
  
  If the field you click already exists in the search box, it will be replaced by this newly added one. If the field is added for the first time, fields in the search box are searched using the AND operator.
4. In the search area, press the up and down arrows on the keyboard to select a keyword or search syntax from the drop-down list, press Tab or Enter to select a keyword or syntax, and click Search.

Common Log Search Operations

Log search operations include sharing logs and refreshing logs.

**Table 1** Common operations
Operation	Description
Creating quick search criteria	Click to create a quick search.
Sharing logs	Click to copy the link of the current log search page to share the logs that you have searched.
Refreshing logs	You can click to refresh logs in two modes: manual refresh and automatic refresh. Manual refresh: Select Refresh Now from the drop-down list. Automatic refresh: Select an interval from the drop-down list to automatically refresh logs. The interval can be 15 seconds, 30 seconds, 1 minute, or 5 minutes.
Copying logs	Click to copy the log content.
Viewing context of a log	Click to view the log context.
Simplifying field details	Click to view the simplified field details.
Unfold/Fold	Click to display all the log content. Click to fold the log content. NOTE: Unfold is enabled by default.
Downloading logs	Click . On the displayed Download Logs page, click Direct Download or Transfer and Download. Direct Download: Download log files to the local PC. Up to 5000 logs can be downloaded at a time. Select .csv or .txt from the drop-down list and click Download to export logs to the local PC. NOTE: If you select Export .csv, logs are exported as a table. If you select Export .txt, logs are exported as a .txt file.
Collapse all/Expand all	Click to set the number of lines displayed in the log content. Click to close it. NOTE: By default, logs are not collapsed, and two rows of logs are shown after collapsing. You can display up to six rows.
Layout	Move the cursor over and choose Layout from the drop-down list. On the displayed Layout page, specify whether to simplify field display and show fields. Simple View: If this is enabled, the fields are displayed in a simplified manner. Show/Hide: When the visibility of a field is disabled, the field is not displayed in the log content.
JSON	Move the cursor over , click JSON, and set JSON formatting. NOTE: Formatting is enabled by default. The default number of expanded levels is 2. Formatting enabled: Set the default number of expanded levels. Maximum value: 10. Formatting disabled: JSON logs will not be formatted for display.
Invisible fields ()	This list displays the invisible fields configured in the layout settings. The button is unavailable for log streams without layout settings configured. If the log content is CONFIG_FILE and layout settings are not configured, the default invisible fields include appName, clusterId, clusterName, containerName, hostIPv6, NameSpace, podName, and serviceID.