Docs

Torch Log Service

Query log

Query logs via phrase query

TLS provides phrase query feature for exact matching of the specified phrase. This topic describes the basic features, syntax, usage restrictions, and examples of phrase queries.

Query types

TLS supports both phrase and non-phrase queries. Details are shown in the table below:

Query types	Description
Non-phrase query	Keyword matching is performed using delimiter, which means the phrase is split into individual keywords based on the index delimiter for querying. For example, if the full-text index is enabled and the delimiter includes a space, when running the query statement "error warn", TLS will query using the error AND warn statement. As long as the log contains both keywords error and warn, the log entry will be retrieved.
Phrase query	Precisely match logs containing the specified phrase. For example, if the full-text index is enabled and the index delimiter includes spaces, then when you run the phrase query statement #"error warn", the log will only be retrieved if it contains the complete phrase error warn.

Basic syntax

Phrases are queried using the pound sign (#) as an identifier.

For example, if the separator is a space, the syntax for a phrase query is described as follows:

Query methods	Phrase query syntax	Non-phrase query syntax
Key-value query	key:#"abc def"	key: "abc def"; equivalent to key: abc AND key: def.
Full-text query	#"abc def"	"abc def"; equivalent to abc AND def.

Basic principles

The basic principles of phrase query are as follows:

After TLS backend receives a phrase query request, it first executes the corresponding non-phrase query statement to retrieve logs.

For example, when performing a phrase query #"abc def", the backend actually first runs abc AND def to complete token matching.

The TLS backend selects logs matching the target phrase from the above retrieval results and returns the final query result.

As shown in the figure below, the purple bar chart represents the phrase query results, while the blue bar chart shows the non-phrase query results.

Notice

To avoid excessive data volume, the phrase query matches up to 10,000 logs.

After performing a phrase query, the log distribution histogram displays the results of the non-phrase query.

For phrase query results, only consecutive paging forward or backward is supported; random skips are not supported.

Phrase queries do not support fuzzy search.

Phrase query statements must include half-width double quotation marks ("").

The phrase query statement does not support using the NOT operator, for example, not #"abc def" is not supported.

The phrase query statement does not support using SQL syntax, for example, #"abc def" | select *** is not supported. Therefore, quick analysis is not supported when using phrase queries.

Continue scanning and paging

When the number of logs matching the phrase query reaches the number you specified per page, or when a single scan reaches 10,000 logs, the system stops the query and returns the phrase query results.

If the page shows Continue scanning or allows paging, it means only part of the logs were scanned for this phrase query. You can click Continue scanning or use paging to keep querying.

The number of logs matching the phrase query reaches the number you specified per page.

As shown above, the total number of logs is 598. When 311 logs are scanned, and the number of logs matching the phrase query reaches your specified limit of 20, the system stops querying and returns these 20 logs. When you click Continue scanning or use paging, the system automatically performs a second phrase query on the subsequent logs and returns results that meet the conditions.

For phrase queries, you can select up to 10,000 logs for phrase matching.

For each phrase query, a maximum of 10,000 logs are used for phrase matching. During the page-turning operation, some pages may show fewer logs than the specified number per page, but you can still continue scanning. This means the number of logs matching the non-phrase query exceeds 10,000, but within the current 10,000 logs for the phrase query, fewer logs match the phrase conditions than the specified number to display.

For example, provided that a total of 40,000 logs exist and you set 100 logs to display per page. If after a phrase query only 40 logs appear on the current page but scanning can continue, it means only 40 logs in the current 10,000 meet the phrase query condition. When you continue paging, TLS will automatically perform the second phrase query in the next set of 10,000 logs and return the logs that match the conditions.

Query example

Example 1 Full-text index

If the full-text index is enabled and the delimiter includes spaces, the query will search for logs containing open failed.

The results for non-phrase queries and phrase queries are as follows.

Non-phrase query

If you run the "open failed" statement, logs that contain both open and failed will be returned.

Phrase query

When you run the #"open failed" statement, TLS matches the complete phrase open failed.

Example 2 Key-value index example

When key-value indexing is enabled for the result field and the index delimiter includes a half-width colon (:), you can query logs where the result field contains "shard_id":0. You need to escape double quotes (") in the query statement, such as "\"shard_id\":0".

The results for non-phrase queries and phrase queries are as follows.

Non-phrase query

When you run the result: "\"shard_id\":0" statement, logs are returned if the result field contains both shard_id and 0, but precise matching logs for "shard_id":0 are not guaranteed.

Phrase query

When running result: # "\"shard_id\":0" statements, TLS will precisely match the complete phrase "shard_id":0 in the result field.

Last updated: 2026.07.30 17:29:25