Docs

Torch Log Service

Analyze logs

Analysis overview

TLS offers real-time data analysis based on log query. It supports real-time query and analysis of massive log data, performs SQL analysis and computation based on query results, and displays analysis outcomes using charts.

Limits

Limit items	Description
Data volume	A single shard supports analyzing up to 1 GiB of data per operation.
Query and analysis statement length	The maximum length of a single query and analysis statement is 50,000 characters. Within the statement, the maximum length of the query part is 4,096 characters.
Field value size	The maximum size of a single field value is 16KB, i.e., 16,384 bytes. If exceeded, the excess part will not be analyzed. The default maximum length for field values in TLS is 2,048 bytes, i.e., 2 KB. If you need to adjust the maximum length of field values, you can set maximum length for statistic fields. For specific steps, see Set the maximum length of the field. Notice Updating the configuration only affects incremental data.
Operation concurrency	Standard storage: The maximum number of concurrent operations under one single project is 100. The maximum number of concurrent operations under one single topic is 15. Infrequent access storage: The maximum number of concurrent operations under one single project is 2. Notice When the logs that need query and analysis includes both standard storage and infrequent access storage, the concurrency limit of infrequent access storage applies.
Data activation mechanism	Analysis functions only apply to data that is written after the statistics function is enabled. For fields without enabled statistics function, the SQL analysis result shows as empty.
Data activation mechanism		SQL analysis only applies to data that corresponds to the latest index version. Data before index modification can be queried but is excluded from SQL analysis.
Timeout	The query operation timeout is 55 seconds.
Number of results	By default, 100 results are returned per analysis. If you need to return more data, use LIMIT syntax. In this case, up to 100,000 results can be returned.

Log analysis

Enter your query and analysis statement in the TLS query and analysis page, specify the log time range and topic, and instantly perform log query and analysis. For detailed steps, see Log analysis.

The query and analysis condition consists of a query statement and an analysis statement. They are separated by an English vertical bar (|), which means that analysis and calculation are performed on data filtered by the query condition.

Structure of a query and analysis statement:

Query condition: used to specify filtering rules, which means that analysis and calculation are performed on data filtered by the query condition. Log queries must follow the correct syntax. Log query supports both full-text and key-value query. Query precision includes exact match and fuzzy match, and you can also use a space or an asterisk (*) to return all data. For more details, see Query overview and Query syntax.

If log analysis is not required, simply enter the query condition.

SQL analysis statement: specifies how to analyze and calculate the query results. Various SQL functions and syntax are supported. For detailed instructions, see Analyze syntax.

If you need to analyze log data, you must enter both the query condition and the SQL analysis statement.

Notice

Generally, you do not need to set a FROM clause in an SQL analysis statement. By default, data from the specified log topic will be analyzed. Except for the innermost layer of a nested query, which means within a nested subquery, FROM clause is required to specify in the SELECT statement.

SQL analysis statements do not support using offset; do not need to be case-sensitive; do not require a semicolon (;) at the end of the statement.

In analysis statements, use single quotation marks ('') to enclose characters that represent strings. Characters with no quotes or with double quotation marks ("") represent field names or column names. For example, 'time' represents a string, time or "time" represents a field name or column name.

Query and analysis statement examples:

Analysis scope	Query and analysis statement examples	Description
Analyze logs based on full data	* \| SELECT status, count(*) AS PV GROUP BY status	Count visits by status code.
Analyze logs based on query results	status:200 \| SELECT COUNT(*) AS PV	Count the number of visits in requests with status code 200.

Last updated: 2026.01.04 16:33:02