Docs

Torch Log Service

Query log

Query overview

For logs collected to the server, TLS provides the following capabilities: real-time query; query massive log data at second-level; match fields in logs via query statements; quickly filter and query targeted information.

TLS supports log query and analysis. If you only need to filter and query log data without performing statistical analysis, you can simply enter the query condition in the input box, specify the log time range, and select the log topic. For detailed steps, see Query log by single topic. TLS queries and returns logs that match the specified query conditions. For instance, if status:500 is used to query access logs, access logs whose HTTP Code is 500 will be returned.

Query condition syntax

TLS supports filtering logs by topic, time, and query conditions.

Log topic: if you specify a log topic to query, only log data under that topic is queried.

Log time: If you filter logs according to the log timestamp, you can view data that matches the query condition within the specified time period. If the search box is empty or contains only spaces, all logs within the specified time period will be displayed.

Query condition: Only logs that match the filters entered during log query are returned. Query conditions support various logical and mathematical operators. For a detailed list of syntax, see Query syntax.

Limits

Limit items	Description	Note
Number of characters per single field	After tokenizing logs, the length of each token must not exceed 255 bytes.	If the limit is exceeded, this log can not be queried by keywords. However, the server still retains the complete log data.
Query statement length	The maximum length for a single search statement is 4,096 characters.	/
Phrase query	For phrase queries, you can select up to 10,000 logs for phrase matching.
Operation concurrency	Standard storage: The maximum number of concurrent operations under one single project is 100. The maximum number of concurrent operations under one single topic is 15. Infrequent access storage: a single project supports up to 10 concurrent operations. Notice When the log query range includes both standard and infrequent access storage, the operation concurrency of infrequent access storage applies.	/
Timeout	The query operation timeout is 55 seconds.	/
Fuzzy query	During fuzzy queries, TLS queries up to 100 matching words. Then TLS returns all logs containing those words that meet the query conditions.	/
Keyword search	When querying keywords, you can specify up to 30 query conditions each time.	/
Return results	By default, each query returns up to 100 results.	/
Query result sequence	By default, log display starts from the latest logs. The time can be set precisely down to seconds or milliseconds.	/
Single log content display	Limited by web browser performance, for logs that exceed 10,000 characters, the TLS only processes the first 10,000 characters for DOM tokenization.	If the log data exceeds 10,000 characters, the console displays "Log data exceeds 10,000 characters. The display of partial logs may be downgraded."

Log query methods

Notice

Before querying logs, make sure you have collected log data using LogCollector or other methods, and correctly set up the index. For steps on setting indexes, see Configuration Index.

Query logs through the console: Go to TLS console and locate the specified project and log topic. Then perform the query on the corresponding query and analysis page. For detailed steps and precautions, refer to log query.

Query logs via API: TLS provides a series of query-related API interfaces for you to use.

SearchLogs: Query logs.

DescribeHistogram V1: Query logs and view the time distribution of log data that meets the condition.

DescribeLog Context: View the context information of specified logs.

Last updated: 2025.12.30 18:21:46