Docs

Torch Log Service

Log management API

SearchLogs

Call the SearchLogs interface to query the logs of a topic.

Usage notes

The related interfaces (SearchLogs, DescribeLogContext, and DescribeHistogram) share a quota for call frequency and concurrent limits, with specific restrictions as follows:

For a single Volcano Engine account or IAM user, the request frequency limit for log query is 100 times/second, otherwise, the error ExceedQPSLimit will be received.

For a single topic, the concurrent limit for log query is 15, otherwise, the error ExceedCountLimit will be received.

tip

Before calling this interface, it is recommended to read Query overview and Analysis overview to understand the capabilities and limitations of log query and analysis functions, as well as the supported query syntax and SQL analysis syntax.

Before querying logs, please make sure that the index has been enabled. If you need to count the logs, the field index and statistics should have been enabled for the log fields involved in the statistics.

The storage time of log data in Torch Log service is determined by the Log storage period of the topic. Logs that have expired and been deleted cannot be queried.

Request syntax

Request Method: POST

Request URL: https://{tls-endpoint}/SearchLogs

Request parameters

The table below only lists the request parameters specific to this interface and some common parameters. For more information, please see Common parameters.

Body

Name	Type	Required	Example	Description
TopicId	String	True	4a********	The ID of the topic.
Query	String	True	error	The query and analysis statements. The maximum length of the statement is 4 KiB. Please refer to Analysis overview for the structure of the query and analysis statement. For the syntax of the query statement, please refer to Log query syntax, and for the list of supported SQL analysis syntax and functions, please refer to Analysis overview.
StartTime	Integer	True	1346457600000	The start time of the query, accurate to the millisecond. It is in unix timestamp format, representing the number of milliseconds calculated from January 1, 1970, 00:00:00 UTC. If specified at the second level, the server will automatically convert the precision to milliseconds.
EndTime	Integer	True	1630454400000	The end time of the query, accurate to the millisecond. It's in unix timestamp format, representing the number of milliseconds calculated from January 1, 1970, 00:00:00 UTC. If specified at the second level, the server will automatically convert the precision to milliseconds.
Limit	Integer	False	30	This parameter is used to indicate the amount of data per page when displaying the query results in pages. The maximum value is 1000, and it can return up to 20MiB of the logs at a time, and up to 100,000 entries through pagination. warning This parameter is required when only query the logs, there are only query statements in the Query parameter, and no analysis statements. When query and analyze at the same time, the number of log entries to be returned should be specified through the LIMIT syntax in the Query parameter. The usage of this parameter is equivalent to the traditional pagination parameter PageSize, which is different from the LIMIT syntax of Torch Log Service.
Context	String	False	[1650349469000, 130,9, null]	This is used to specify the position for a secondary query during a follow-up search, typically used in context search scenarios. Each time the SearchLogs interface is called, it will also return the data end point. If you need to view subsequent log information, you can call the SearchLogs interface again, and pass in the Context obtained from the last response in the request. tip This parameter takes effect when only query the logs, there are only query statements in the Query parameter, and no analysis statements. Pagination is not supported during simultaneous query and analysis.
Sort	String	False	desc	Return logs in order of log timestamps, accurate to the millisecond. desc: (default value) Return logs in reverse chronological order, with the newest logs first. asc: Return logs in chronological order, with the oldest logs first. tip This parameter takes effect when only query the logs, there are only query statements in the Query parameter, and no analysis statements.
HighLight	Boolean	False	false	Whether the search keywords are highlighted in the query results.
AccurateQuery	Boolean	False	true	Whether to query logs with nanosecond precision. true: Query logs with nanosecond precision. false: Query logs with millisecond precision.

Responses

The table below only lists the return parameters specific to this interface. For more information, please refer to the Response message.

Name	Type	Example	Description
ResultStatus	String	complete	The status of the query. complete: The query is complete, and the full results are returned. incomplete: The query is complete, and the partial results are returned. error: The query is incomplete, and an error is returned. time_out: The query has timed out, the returned results may be incomplete.
ListOver	Boolean	true	Whether all results have been returned. true: All results have been returned. false: Not all results returned, you can pass in the context to continue the query. tip This parameter is valid if there are only query statements in the Query parameter, and no analysis statements.
Analysis	Boolean	false	The type of the returned result. true: The result of the analysis is returned. false: The result of the query is returned.
Count	Integer	0	Analyze the number of entries hit by the request.
Limit	Integer	0	the limit number of log entries to return is specified in the request. Default is 100. Only when query logs, return the value specified in the request parameter limit. When query and analyze logs, return the number of log entries specified by the LIMIT syntax in the SQL analysis statements.
Context	String	[1650349469000, 130,9, null]	This is used to specify the continuation point for a secondary query, typically used in scenarios such as context queries. Each time the SearchLogs interface is called, it will also return the end point of the data. If you need to view subsequent log information, you can call the SearchLogs interface again and pass in the Context obtained from the last response in the request.
Logs	Array of JSON Map	/	The returned list of log entries, where: __path__: The path and filename of the log. __source__: The source IP address of the log. __time__: The time of the log was generated. __content__: The full text of the log. __context_flow__: The ID of the log group where the initial log is located. __package_offset__: The sequence number of the initial log in the log group.
AnalysisResult	Object of AnalysisResult	/	Analysis results.
HighLight	Array of JSON Map	/	The highlighted keywords.
ElapsedMillisecond	Integer	100	The time used for this query, with the unit of milliseconds.

AnalysisResult

Name	Type	Example	Description
Data	Array of JSON Map	[{ "KeyInfo": "key:000000000940", "KeyType": "string", "ValueLen": "1", }]	The returned key-value pairs from the analysis results.
Type	JSON Map	{ "KeyInfo": "text", "KeyType": "text", "ValueLen": "long", }	The attributes corresponding to the log analysis column.
Schema	Array of String	["KeyType","ValueLen","KeyInfo"]	The names of the columns for log analysis.

Sample Request 1

Sample Response 1

Sample Request 2

Sample Response 2

Sample Request 3

Sample Response 3

Error code

The following table lists the error codes related to the interface and business logic. For common error codes, please refer to the Common error codes.

HTTP status code	Error code	Error message	Description
400	InvalidArgument	Invalid argument key %s, value %s, please check argument.	The parameter is invalid.
400	SqlSyntaxError	Sql syntax Error,details: Function [%s] cannot work with [%s]. Usage: SUM(NUMBER T) -\u003e T	SQL format or syntax error.
404	TopicNotExist	Topic does not exist.	The topic does not exist.
500	InternalServerError	We encountered an unexpected server error, please try again later.	Internal server error.
400	SearchSyntaxError	The key-value index for field (%s) is not configured.	The key-value index has not been configured for the query field.

Last updated: 2025.10.29 14:35:21