Query Statements
A query statement is used to specify the filter criteria for log query and return the logs that meet the filter criteria. By setting filter criteria, you can quickly query required logs.
This topic describes query statements and examples.
Syntax
A query statement can be in either of the following formats:
- If the value is only *, full data is returned without filtering.
- It consists of one or more query clauses. The clauses are connected by NOT, AND, and OR. () can be used to increase the priority of the query conditions in parentheses.
The basic structure of a query clause is as follows:
Field Name Operator Field Value
Operators lists the operators that can be used.
Operators
| Operator | Description |
|---|---|
| = | Queries logs in which the value of a field is equal to a certain value. |
| <> | Queries the logs in which the value of a field is not equal to a certain value. |
| > | Queries logs in which the value of a field is greater than a specified value. |
| < | Queries logs in which the value of a field is less than a specified value. |
| >= | Queries logs in which the value of a field is greater than or equal to a specified value. |
| <= | Queries logs in which the value of a field is less than or equal to a specified value. |
| IN | Queries the logs whose field values are within a specified value range. |
| BETWEEN | Queries the logs whose field values are in the specified range. |
| LIKE | Searches for logs of a field value in full text. |
| IS NULL | Queries logs whose field value is NULL. |
| IS NOT NULL | Queries logs with the value of a specific field set to NOT NULL. |
Query Statements
| Query Requirement | Query Statement |
|---|---|
| All logs | * |
| Logs about successful GET requests (status codes 200 to 299). | request_method = 'GET' AND status BETWEEN 200 AND 299 |
| Logs of GET or POST requests | request_method = 'GET' OR request_method = 'POST' |
| Logs of non-GET requests | NOT request_method = 'GET' |
| Logs about successful GET or POST requests | (request_method = 'GET' OR request_method = 'POST') AND status BETWEEN 200 AND 299 |
| Logs of GET or POST request failures | (request_method = 'GET' OR request_method = 'POST') NOT status BETWEEN 200 AND 299 |
| Logs of successful GET requests (status code: 200 to 299) whose request time is greater than or equal to 60 seconds. | request_method = 'GET' AND status BETWEEN 200 AND 299 AND request_time >= 60 |
| Logs whose request time is 60 seconds. | request_time = 60 |
Example Query Statements
The following is an example of data selected from the i_sec_hss_log table. The data is for reference only.
| __time | hostName | hostUuid | hostIp | region | ipList |
|---|---|---|---|---|---|
| 2025-07-12T14:38:27.764+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T20:38:54.025+08:00 | ecs-574a | 827e17d7-4443-4d6e-9dff-7c10f29efa74 | 10.75.197.134 | cn-north-7 | 172.17.0.1,192.168.0.77 |
| 2025-07-12T20:38:54.025+08:00 | ecs-574a | 827e17d7-4443-4d6e-9dff-7c10f29efa74 | 10.75.197.134 | cn-north-7 | 172.17.0.1,192.168.0.77 |
| 2025-07-12T14:38:55.356+08:00 | hcss_ecs_3924 | c4c5ee97-b82e-443a-b0b5-cd897a5488d8 | 10.75.196.207 | cn-north-7 | 192.168.4.168 |
| 2025-07-12T14:38:55.356+08:00 | hcss_ecs_3924 | c4c5ee97-b82e-443a-b0b5-cd897a5488d8 | 10.75.196.207 | cn-north-7 | 192.168.4.168 |
| 2025-07-12T14:38:55.356+08:00 | hcss_ecs_3924 | c4c5ee97-b82e-443a-b0b5-cd897a5488d8 | 10.75.196.207 | cn-north-7 | 192.168.4.168 |
| 2025-07-12T14:38:55.356+08:00 | hcss_ecs_3924 | c4c5ee97-b82e-443a-b0b5-cd897a5488d8 | 10.75.196.207 | cn-north-7 | 192.168.4.168 |
| 2025-07-12T14:38:59.248+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T14:39:31.747+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T14:40:03.233+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T14:40:35.735+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T20:40:57.086+08:00 | ecs-574a | 827e17d7-4443-4d6e-9dff-7c10f29efa74 | 10.75.197.134 | cn-north-7 | 172.17.0.1,192.168.0.77 |
Example: Query the host whose IP address is 192.168.12.58.
ipList = '192.168.12.58'
| __time | hostName | hostUuid | hostIp | region | ipList |
|---|---|---|---|---|---|
| 2025-07-12T14:38:27.764+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T14:38:59.248+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T14:39:31.747+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T14:40:03.233+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
| 2025-07-12T14:40:35.735+08:00 | HCSS-ECS-8253 | bf9d44b0-45e2-46a3-9d23-c9965051abb6 | 100.64.129.14 | cn-north-7 | 192.168.12.58 |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
