Torch Log Service
Torch Log Service
Torch Log Service
Document
Product News
Product Overview
Product Billing
User Guide
TLS Agent
AgentLoop
Resource management
Host group
Data collection
LogCollector collection
Introduction to LogCollector
Installation and upgrade
Collect host logs
Collect container logs
LogCollector plugins
Manage LogCollector
general reference
Data import
Cloud product log collection
TOS log collection
DBW log collection
VPN Log collection
VKE log collection
CLB log collection
CloudTrail log collection
CFW log collection
NTA log collection
ALB log collection
APMPlus log collection
veFaaS log collection
VPC log collection
veImageX log collection
TrafficRoute DNS log collection
DDoS log collection
WAF log collection
DCDN log collection
Multi-cloud security platform log collection
APIG log collection
Machine learning task log collection
CR log collection
Volcano Ark application lab log collection
FileNAS log collection
LLM Application Firewall Service log collection
vePFS log collection
Cloud security center log collection
EFS log collection
Data storage
Query and analysis
Configure log indexes
Query log
Analyze logs
Query and analyze logs using third-party tools
Associate external data source for log query
SQL function
SQL syntax
Visualization
Query and analysis charts
Summaries of query and analysis charts
Create dashboard
Use dashboard
Add dashboard filters and variables
Use other systems to analyze logs
Log application
Log applications for product observability
Log applications for large models observability
Coding Agent log app
ModelProvider log app
No-coding Agent log app
Log applications for basic service monitoring
Data processing
Data transformation
Syntax and functions
Global operation function
expression function
Data processing best practices
general reference
Data write processor
Data consumer processor
Data consumption and shipping
Ship logs to TOS
Ship logs to Kafka
Ship logs to Splunk
Alarm
Alarm policy
Alarm notification content
Alarm notification content template
alarm notification channel
Tracing service
Monitor Log Service
API reference
Project management API
Topic management API
Shard management API
Index management API
Log management API
Host group management API
Collection configuration management API
Data import API
Data processor API
Data transformation API
Data backflow API
SQL analysis API
Alarm management API
Consumer group management API
Kafka protocol consumption API
Tag management API
Trace storage API
Account management API
SDK reference
Go SDK
Java SDK
Python SDK
iOS SDK
C++ SDK
CLI reference
Best practices
Data collection
Query and analysis
permission management
Consumption and delivery
Visualization
Alarm
FAQs
Billing and cost FAQ
Data collection FAQ
Data storage FAQ
Index configuration FAQ
Query and analysis FAQ
Scheduled SQL tasks FAQ
Alarm FAQ
- Documentation
Torch Log ServiceUser GuideAlarmAlarm policyMulti-statement set operation
Copy page
Download PDFAlarm policy
Multi-statement set operation
Copy pageDownload PDFMulti-statement set operation
A TLS alert monitoring task treats a query and analysis result as a set and supports associating up to three sets for monitoring.
Notice
- The monitoring task selects up to the first 1,000 rows of data from the set operation results to trigger alerts.
- When monitoring three sets, the task selects up to the first 100 rows from each query and analysis result for set operations. It performs operations on the first two sets, and then combines the results with the third set for further set operations.
How it works
A TLS alert monitoring task treats a query and analysis result as a set, and supports connecting multiple sets using Cartesian product, left join, and right join methods to create a result set for alert triggering.
Set operation | Diagram | Description |
Set operation | Diagram | Description |
Cartesian product | | Pair each row of data to generate a result set with a size equal to the product of the row counts. |
Do not merge | | Only use the first data item for query and analysis. The second data can only be referenced in variable fields within content templates. |
Union | | Merge columns from different tables into one table. The merged column will be named OriginalDataSourceName. |
Left join | | Match data using specified columns (such as id). If a row from the left table does not have a match in the right table, the right table fields for that row will display null in the result set. |
Right join | | Match data using specified columns (such as id). If a row from the right table does not have a match in the left table, the left table fields for that row will display null in the result set. |
Inner join | | Match data using specified columns (such as id), and only keep intersecting rows. |
Full join | | Match data using specified columns (such as id) and keep all rows. |
Left anti join | | Remove data from the left data source that exists in the right data source, which means that the right data source serves as a denylist for the left data source. |
Right anti join | | Remove data from the right data source that exists in the left data source, which means that the left data source serves as a denylist for the right data source. |
Example of set operation
Statement configuration
The following statements are for demonstration purposes only.
- 1 execution statement
- | SELECT uid,region
- 2 execution statements
- | SELECT uid,region,COUNT(*) AS total GROUP BY uid,region
- Set operations: See examples for each type of set operation.
Execution statement result
The following execution results are provided as examples only.
- The result of 1 execution statement
- uidregionuidregion10001beijing10002shanghai10003guangzhou
- The result of 2 execution statements
- uidregiontotaluidregiontotal10001beijing1810002shanghai2010004shenzhen19
Result of set operation on execution statements
Cartesian product result
- $1.uid$1.region$2.uid$2.region$2.total$1.uid$1.region$2.uid$2.region$2.total10001beijing10001beijing1810001beijing10002shanghai2010001beijing10004shenzhen1910002shanghai10001beijing1810002shanghai10002shanghai2010002shanghai10004shenzhen1910003guangzhou10001beijing1810003guangzhou10002shanghai2010003guangzhou10004shenzhen19
No merge result
- $1.uid$1.region$1.uid$1.region10001beijing10002shanghai10003guangzhou
Merge result
- $1.uid$1.region$2.uid$2.region$2.total$1.uid$1.region$2.uid$2.region$2.total10001beijing10001beijing1810002shanghai10002shanghai2010003guangzhou/////10004shenzhen19
Inner join result
- Set operation: condition is $1.uid==$2.uid
- $1.uid/$2.uid$1.region$2.region$2.total$1.uid/$2.uid$1.region$2.region$2.total10001beijingbeijing1810002shanghaishanghai20
Full join result
- Set operation: condition is $1.uid==$2.uid
- $1.uid/$2.uid$1.region$2.region$2.total$1.uid/$2.uid$1.region$2.region$2.total10001beijingbeijing1810002shanghaishanghai2010003guangzhou//10004/shenzhen19
Left join result
- Set operation: condition is $1.uid==$2.uid
- $1.uid$1.region$2.region$2.total$1.uid$1.region$2.region$2.total10001beijingbeijing1810002shanghaishanghai2010003guangzhounullnull
Right join result
- Set operation: condition is $1.uid==$2.uid
- $2.uid$1.region$2.region$2.total$2.uid$1.region$2.region$2.total10001beijingbeijing1810002shanghaishanghai2010004nullshenzhen19
Left anti join result
- Set operation: condition is $1.uid==$2.uid
- $1.uid$1.region$1.uid$1.region10003guangzhou
Right anti join result
- Set operation: condition is $1.uid==$2.uid
- $2.uid$2.region$2.total$2.uid$2.region$2.total10004shenzhen19
Last updated: 2026.03.31 11:32:38
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
