Search Page

Last updated: 2021-08-31 16:24:03

    When users use the search page to analyze the logs, the search results may be empty or error messages may appear, such as QueryError, SyntaxError. The common problems and scenarios are summarized as below:

    The page displays that the search result is empty

    • Common reason 1: the log was not collected successfully.
      Solution: for more information on troubleshooting, please see Log Search Failure.

    • Common reason 2: no wildcard is used when logs that contain only a part of the keyword segment are searched for.
      Scenario: you wanted to search for logs whose user-agent field contained Window, such as Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322). After you entered the search statement user-agent:Window, the search result was empty. The reason is that Window is not a complete segment and cannot be searched separately.
      Solution: use wildcard * to search for user-agent:Window*.

    • Common reason 3: an SQL statement is used to analyze log data, but spaces are not added before and after the pipe symbol.
      Scenario: the SQL statement you entered was *|SELECT *. As you didn't add spaces before and after the pipe symbol, CLS used the entire statement as a keyword for full-text search for log data containing "*|SELECT *".
      Solution: Add a space before and after the pipe character, e.g. *|SELECT *.

    Query statement with error message

    Common error messages, causes and solutions are as follows:

    .

    Error Message Cause Solution
    QueryError [illegal_argument_exception.Cannot search on field [xxx] since it is not indexed The index is not enabled for the queried field `xxx` Enable the index for this field. For details, please see Configuring Index
    QueryError [illegal_argument_exception.Cannot search on Full-Text since it is not indexed.] Full-text index is not enabled Enable the full-text index. For details, please see Full-Text Index
    QueryError [illegal_argument_exception.syntax error on field [and|or|not], or full text search is closed] The search condition does not support lowercase logical operators, which will be regarded as normal fields for full-text search Use the upper-case logical operators AND|OR|NOT. If you do not need to use logical operators but to search for and/or/not, please enable full-text index.
    QueryError [number_format_exception.For input string: "&dxgt;"] Syntax error of numerical comparison statement Check whether there are special symbols such as spaces around the numerical comparison symbols. An example of correct format: status:>400
    QueryError [parent_circuit_breaking_exception.[parent] Data too large, data for [] would be [xxx/xxxgb] The query data volume is too large Reduce the query time range as appropriate, and specify more precise query conditions
    QueryError [parse_exception.parse_exception: Cannot parse 'xxx': '*' or '?' not allowed as first character in WildcardQuery Fuzzy query by prefix is not allowed, e.g. content:*examplecontent:*example We recommend using separators to split a field into multiple ones. For details, please see Configuring Index
    QueryError [sql_illegal_argument_exception.cannot cast [13/Jul/2021:17:04:34] to [datetime]: failed to parse date field [13/Jul/2021:17:04:34] with format [date_optional_time]] `cast` cannot convert dates in `13/Jul/2021:17:04:34` format. Only ISO standard format and millisecond-level Unix timestamp are supported, e.g. yyyy-MM-dd'T'HH:mm:ss.SSSZ or yyyy-MM-dd. Modify the format of the time field or use the __TIMESTAMP__ built-in field
    QueryError [verification_exception.Cannot order by non-grouped column [xxx], expected [xxx] or an aggregate function Statistics is not enabled for the field `xxx` and thus it cannot be used for sorting Enable statistics for this field. For details, please see Log Analysis Overview
    QueryError [verification_exception.Cannot use non-grouped column [xxx], expected [xxx]] Statistics is not enabled for the query field `xxx` Enable statistics for this field. For details, please see Log Analysis Overview
    QueryError [verification_exception.Field [xxx] of data type [text] cannot be used for grouping] Statistics is not enabled for the field `xxx` and thus it cannot be used for grouping Enable statistics for this field. For details, please see Log Analysis Overview
    QueryError [verification_exception.Unknown column [xxx]] The query field `xxx` does not exist Check whether the field name is correct
    SyntaxError[xxx] There is a syntax error in part of the SQL statement Please see the detailed tips in the error message to fix the syntax error, where line x,column x does not contain the search condition part (i.e. "|" and the part before it)
    SearchTimeout The query is timed out Reduce the scope of data query and SQL complexity as appropriate, or try again later.
    LimitExceeded.LogSearch The search concurrency exceeds the limit Try again later