Docs

Torch Log Service

Query and analysis

Analyze data using log clustering

Log clustering aggregates similar logs and extracts common log patterns, allowing you to quickly summarize large volumes of log data and know the overall log landscape. The extracted log information can be used for issue identification, exception detection, version rollback, and other operations tasks.

Notice

This feature is now supported in regions: China (Beijing), China (Guangzhou), China (Shanghai), Asia Pacific (Johor).

How it works

TLS supports clustering of log data filtered by any condition. It extracts similar patterns so you can quickly know the overall log situation and identify logs that require attention. You can trace back to the original data by category and add clustering results to the dashboard for analysis and monitoring.

Log clustering: uses clustering algorithms to group large volumes of log data into different patterns, placing similar log entries together.

Log pattern: The log pattern represents a set of logs with similar characteristics. Each log pattern contains one or more sub-patterns.

Log template: The log template is used to adjust the accuracy of the clustering algorithm. A higher accuracy value means more detailed classification of clustering results and more pattern details.

Comparison time point: used to compare the number of log patterns in two time periods.

Billing notes

Log clustering is free of charge for now. We will release billing notes in the upcoming announcement.

Prerequisites

Logs have been collected.

Indexing has been configured for the logs. If you need to set allowlist or denylist for log clustering, you also need to configure Key-value index.

Steps to enable log clustering

Select the region where TLS is located from the top navigation bar.

On the left navigation bar, select Common functions > Query and analysis.

On Query and analysis page, a list is displayed in the left area. Select the specified project and topic.

On the query and analysis page of the log topic, click Index configuration.

On the index configuration page, enable Log clustering, and then set the allowlist or denylist for log clustering.

No whitelist or blacklist: cluster all fields.

Whitelist: only cluster fields in the allowlist.

Blacklist: exclude fields in the denylist during clustering.

Notice

Enable Key-value index for the log topic before configuring feature fields.

Click OK.

Steps for using log clustering

View clustering results

When users receive alerts or other exceptions, they can go to the log query page to quickly view clustered logs for an overview and to check detailed log entries.

Select the region where TLS is located from the top navigation bar.

On the left navigation bar, select Common functions > Query and analysis.

On Query and analysis page, a list is displayed in the left area. Select the specified project and topic.

Specify the time range in the query and analysis page for the log topic.

By default, the time range is 5 minutes. You can also customize the time range for query. If log data does not fall within the specified query time range, it will not be retrieved.

Enter query condition, and then click Search.

Below the log histogram, select Log clustering chart to view the clustering results.

Adjust log clustering precision

The higher the clustering algorithm's precision, the more detailed the classification of results and the more pattern details of template.

In the template tab under Log clustering, adjust the clustering algorithm precision. Supported range: 1–16.

Compare log clustering results

Log clustering supports time-based comparison to view changes in clustering results within a specific time range. For example, when users receive an alert or other exception, they can compare logs from before and after the fault occurred over a recent period.

Under Log clustering tab, click Select point in time.

Select a comparison time point. The following modes are supported:

Close: No time selected

Quick select: You can quickly select a query time range, such as 5 minutes ago, 15 minutes ago, 1 hour ago, 3 hours ago, 1 day ago, 7 days ago, 30 days ago, or a custom time period.

Manually select: You can manually select a specific time range.

Obtain log clustering analysis statement

You can copy log clustering statements for use in SQL statistical analysis as needed.

Under the Log clustering tab, click Replicate cluster analysis statement and then you can copy the clustering analysis statement to clipboard.

Sample of log clustering analysis statement without query or analysis statement

Turn off comparison time

* | select a.count, a.pattern, a.signature, a.origin_signatures, a.model_version from (select log_reduce(16) as a) order by a.count desc limit 1000

Set comparison time

* | select v.signature, v.pattern, v.count, v.count_compare, v.diff, v.model_version from (select compare_log_reduce(16, 2592000000) as v ) order by v.diff desc limit 1000

Field description

Field	Description
pattern	Specific pattern of the log.
count	The number of log entries for this pattern during the specified query period.
signature	The signature for this pattern.
origin_signatures	The secondary signature for this pattern, which can be used to retrieve the original data.
count_compare	The number of log entries for this pattern in the previous time period.
diff	The difference between count and count_compare.

Add log clustering results to dashboard

After you’ve configured the query statements and precision settings for log clustering, you can add the cluster to the dashboard for future reference. The query statement and precision settings will be recorded when saving.

Under the Log clustering tab, click Add to dashboard.

In the Add to dashboard dialog, enter the following information:

Parameters	Description
Chart name	Name of the chart.
Target dashboard	Add the chart to the target dashboard. Existing dashboard: add the current chart to an existing dashboard. New dashboard: create a new dashboard and add the current chart to it.
Dashboard	Name of the dashboard.
Description	When you set the target dashboard to New dashboard, you can add a description for the new dashboard.

Click OK.

Disable log clustering

Select the region where TLS is located from the top navigation bar.

On the left navigation bar, select Common functions > Query and analysis.

On Query and analysis page, a list is displayed in the left area. Select the specified project and topic.

On the query and analysis page of the log topic, click Index configuration.

On the index configuration page, disable Log clustering, and then click OK.

Last updated: 2026.05.20 16:53:14