Last updated：2020-12-28 14:56:14
To query logs, you must select a LogPool and a time range and enter a query statement. KLog supports full-text queries, key-value queries, and fuzzy queries.
KLog segments each log to multiple phrases by using the specified delimiters so that you can query logs based on keywords. KLog supports the following types of full-text queries:
You can specify field names and field content to query logs. For fields of the double or long type, you can specify a range to query logs. For example, the count>5000 and Status:200 statement returns the logs where the value of the count field is greater than 5000 and the value of the Status field is 200.
|key:value||Queries the logs where the field specified by key contains the specified value. The field must be added to the field index before you can query logs based on the field. By default, all fields are added to the field index. The value can contain an asterisk (*) or a question mark (?).|
|A and B||Queries the logs that contain A and B. If multiple words are not separated with syntax keywords, these words are in the AND relationship by default.|
|A OR B||Queries the logs that contain A or B.|
|exists||Queries the logs that contain the specified field.|
|missing||Queries the logs that do not contain the specified field.|
|?||Represents a single character.|
|*||Represents zero or more characters.|
|TO||Specifies a range. Examples: status:[400 TO 499] and status:[400 TO 499}. In status:[400 TO 499}, the right brace (}) indicates that the value 499 is not included.|
|>||Queries the logs where the value of a field is greater than a specific number.|
|>=||Queries the logs where the value of a field is greater than or equal to a specific number.|
|<||Queries the logs where the value of a field is less than a specific number.|
|<=||Queries the logs where the value of a field is less than or equal to a specific number.|
|=||Queries the logs where the value of a field is equal to a specific number.|
Did you find the above information helpful?
Please give us your feedback.
Thank you for your feedback.