Docs

Torch Log Service

Query and analysis

Query and analysis workflow

This topic describes the basic workflow for query and analysis logs.

1 Configure index

An index is an important data storage structure that helps you quickly find key information in massive logs. Index configuration determines the query method and the accuracy of query results. To achieve optimal query results, configure the appropriate indexes based on the logs you have collected and corresponding query and analysis requirements.

You must configure indexes before performing query and analysis operations. TLS supports full-text index, key-value index, and reserved field index.

full-text index configuration

After enabling the full-text index, TLS splits logs into multiple text-type tokens based on the delimiters. Then you can query the full-text by keywords.

key-value index configuration

After enabling key-value index, TLS first splits logs by field name. Then, it splits field values within each field by delimiters. You can also set index data types for each field, including text, long, double, and json. For an explanation of index data types, see Index data types.

Reserved field index configuration

By default, TLS enables key-value index for some internal reserved fields.

2 Select query method

You can select full-text or key-value query based on your index configuration and query requirements. For more details, see Query methods.

Full-text query

When you set a query statement, you can just enter keywords without specifying a specific log field name. Full-text query is useful for quickly query logs that contain specified keywords, regardless of which field the keyword is included in. For example, you can query by keyword error.

Key-value query

When you set a query statement, you need to specify the field name and field value. Key-value query is suitable for precise queries on known field values, such as using username: joe to query all requests initiated by the user.

3 Select query accuracy

Select either precise query or fuzzy query based on your query needs. For more details, see Query accuracy.

Precise query

If complete keyword is specified during query, query results will match based on complete keyword.

Fuzzy query

If you specify only part of a keyword in query statement (add wildcard asterisk * or question mark ?), TLS matches up to 100 words and returns logs that contain these 100 words and meet the query conditions. If you need to match a series of similar keywords, you can select fuzzy match. For example, if you use cn* in fuzzy match, you can query logs that contain words starting with cn.

4 Construct query and analysis statement

The query and analysis statement consists of a query statement and an analysis statement. They are separated by an English vertical bar (|), which means that analysis and calculation are performed on logs filtered by the query condition. For more details, see log analysis.

Query statements

By specifying query conditions (such as time range and request type) in query statements, you can filter target logs. For details on query syntax, see Query syntax.

Analysis statement

The analysis statement adopts standard SQL-92 syntax for filtering, counting, and aggregating logs. The analysis statement must be used together with the query statement. For details on analysis syntax, see parsing grammar.

5 Run query and analysis operations

On the query and analysis page for the target log topic, select the appropriate time range and enter the query and analysis statement to execute relevant operations. For detailed instructions, see Query log by single topic, Log analysis.

6 View query and analysis results

After executing the query and analysis operation, you can view the results at the bottom of the query and analysis page.

Query result

After filtering logs with a query statement, you can view the filtered log content under the Raw log tab. For more details, see View search results.

Query and analysis results

After executing query and analysis, you can view visualized query and analysis results under the Chart analysis tab. TLS provides a variety of chart types such as tables, line charts, and statistical charts to display query and analysis results. For more details, see View analysis results.

Last updated: 2025.12.29 17:15:31