Querying Structured Logs

Function

This API is used to query structured logs in a specified log stream.

URI

POST /v2/{project_id}/groups/{log_group_id}/streams/{log_stream_id}/struct-content/query

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Project ID. For details about how to obtain a project ID, see Obtaining the Account Tenant ID, Log Group ID, and Log Stream ID. Default: None Minimum: 32 Maximum: 32
log_group_id	Yes	String	Log group ID. Default: None Minimum: 36 Maximum: 36
log_stream_id	Yes	String	Log stream ID. Default: None Minimum: 36 Maximum: 36

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	User token obtained from IAM. Default: None Minimum: 1000 Maximum: 2000
Content-Type	Yes	String	Set this parameter to application/json;charset=UTF-8. Default: None Minimum: 30 Maximum: 30

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
start_time	Yes	String	Start time of the query (UTC, in milliseconds). Minimum: 13 Maximum: 13
end_time	Yes	String	End time of the query (UTC, in milliseconds). Minimum: 13 Maximum: 13
sql_expression	No	String	SQL statement used for search. GROUP BY, LIKE, WHERE, and SELECT are supported. Default: SELECT* Minimum: 0 Maximum: 100 Enumeration values: SELECT* GROUP BY LIKE WHERE
original_content	No	Boolean	Whether raw logs are returned. The default value is false. Default: false

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
struct_logs	Array of StructLogContents objects	Log information. Array Length: 1 - 5000

**Table 5** StructLogContents
Parameter	Type	Description
log_content	String	Raw log data. Minimum: 1 Maximum: 10000
line_num	String	Sequence number of a log line. Minimum: 19 Maximum: 19

Status code: 400

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.

Status code: 401

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.

Status code: 403

**Table 8** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.

Status code: 500

**Table 9** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.

Status code: 503

**Table 10** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.

Example Requests

When sql_expression is set to select count(test3), sum(test4):

v2/{project_id}/groups/{log_group_id}/streams/{log_stream_id}/struct-content/query

{
  "start_time" : "1595811590539",
  "end_time" : "1595811593539",
  "sql_expression" : "select count(test3), sum(test4)"
}

When sql_expression is set to select count(test3), sum(test4) group by(test1):

v2/{project_id}/groups/{log_group_id}/streams/{log_stream_id}/struct-content/query

v2/{project_id}/groups/{log_group_id}/streams/{log_stream_id}/struct-content/query {    "start_time": "1595811590539",    "end_time": "1595811593539",    "sql_expression": "select count(test3), sum(test4) group by(test1)"}

When sql_expression is set to **select ***:

POST https://{endpoint}/v2/{project_id}/groups/{log_group_id}/streams/{log_stream_id}/struct-content/query

v2/{project_id}/groups/{log_group_id}/streams/{log_stream_id}/struct-content/query {    "start_time": "1595811590539",    "end_time": "1595811593539",    "original_content": "true",    "sql_expression": "select *"}

Example Responses

Status code: 200

The request is successful.

When **sql_expression** is set to **select ***:
  "struct_logs": [
        {
            "test4": "151687",
            "test2": "08:59:53",
            "test3": "this",
            "line_num": "1595811593539371695",
            "log_content": "2020-07-27/08:59:53 this log is Error NO 151687\n",
            "test1": "2020-07-27"
        },
        {
            "test4": "151686",
            "test2": "08:59:52",
            "test3": "this",
            "line_num": "1595811592539361171",
            "log_content": "2020-07-27/08:59:52 this log is Error NO 151686\n",
            "test1": "2020-07-27"
        },
        {
            "test4": "151685",
            "test2": "08:59:51",
            "test3": "this",
            "line_num": "1595811591539422860",
            "log_content": "2020-07-27/08:59:51 this log is Error NO 151685\n",
            "test1": "2020-07-27"
        },
        {
            "test4": "151684",
            "test2": "08:59:50",
            "test3": "this",
            "line_num": "1595811590539454127",
            "log_content": "2020-07-27/08:59:50 this log is Error NO 151684\n",
            "test1": "2020-07-27"
        }
]
}

When **sql_expression** is set to **select count(test3), sum(test4)**:
{
    "struct_logs": [
        {
            "cnt(test3)": "4",
            "sum(test4)": "606742.000"
        }
    ]
}

When **sql_expression** is set to **select count(test3), sum(test4) group by(test1)**:
{
    "struct_logs": [
        {
            "cnt(test3)": "4",
            "sum(test4)": "606742.000",
            "test1": "2020-07-27"
        }
    ]
}

When **sql_expression** is set to **select count(test3), sum(test4) group by(test1)**:
{
    "struct_logs": [
        {
            "cnt(test3)": "4",
            "sum(test4)": "606742.000",
            "test1": "2020-07-27"
        }
    ]
}

Status code: 400

BadRequest. Invalid request. Modify the request based on the description in error_msg before a retry.

{
  "error_code" : "LTS.0009",
  "error_msg" : "Failed to validate the request body"
}

Status code: 401

AuthFailed. Authentication failed. Check the token and try again.

{
  "error_code" : "LTS.0414",
  "error_msg" : "Invalid token"
}

Status code: 403

Forbidden.The request is rejected.The server has received the request and understood it, but refuses to respond to it. The client should not repeat the request without modifications.

{
  "error_code" : "LTS.0001",
  "error_msg" : "Invalid projectId"
}

Status code: 500

InternalServerError. The server has received the request but encountered an internal error.

{
  "error_code" : "LTS.0202",
  "error_msg" : "Failed to query lts struct log"
}

Status Codes

Status Code	Description
200	The request is successful.
400	BadRequest. Invalid request. Modify the request based on the description in error_msg before a retry.
401	AuthFailed. Authentication failed. Check the token and try again.
403	Forbidden.The request is rejected.The server has received the request and understood it, but refuses to respond to it. The client should not repeat the request without modifications.
500	InternalServerError. The server has received the request but encountered an internal error.
503	ServiceUnavailable. The requested service is unavailable.