When users use the search page to analyze the logs, the search results may be empty or error messages may appear, such as
SyntaxError. The common problems and scenarios are summarized as below:
Common reason 1: the log was not collected successfully.
Solution: for more information on troubleshooting, please see Log Search Failure.
Common reason 2: no wildcard is used when logs that contain only a part of the keyword segment are searched for.
Scenario: you wanted to search for logs whose
user-agent field contained
Window, such as
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322). After you entered the search statement
user-agent:Window, the search result was empty. The reason is that
Window is not a complete segment and cannot be searched separately.
Solution: use wildcard
* to search for
Common reason 3: an SQL statement is used to analyze log data, but spaces are not added before and after the pipe symbol.
Scenario: the SQL statement you entered was
*|SELECT *. As you didn't add spaces before and after the pipe symbol, CLS used the entire statement as a keyword for full-text search for log data containing "
Solution: Add a space before and after the pipe character, e.g.
Common error messages, causes and solutions are as follows:
|QueryError [illegal_argument_exception.Cannot search on field [xxx] since it is not indexed||The index is not enabled for the queried field `xxx`||Enable the index for this field. For details, please see Configuring Index|
|QueryError [illegal_argument_exception.Cannot search on Full-Text since it is not indexed.]||Full-text index is not enabled||Enable the full-text index. For details, please see Full-Text Index|
|QueryError [illegal_argument_exception.syntax error on field [and|or|not], or full text search is closed]||The search condition does not support lowercase logical operators, which will be regarded as normal fields for full-text search||Use the upper-case logical operators
|QueryError [number_format_exception.For input string: "&dxgt;"]||Syntax error of numerical comparison statement||Check whether there are special symbols such as spaces around the numerical comparison symbols. An example of correct format:
|QueryError [parent_circuit_breaking_exception.[parent] Data too large, data for [
||The query data volume is too large||Reduce the query time range as appropriate, and specify more precise query conditions|
|QueryError [parse_exception.parse_exception: Cannot parse 'xxx': '*' or '?' not allowed as first character in WildcardQuery||Fuzzy query by prefix is not allowed, e.g. content:*example
||We recommend using separators to split a field into multiple ones. For details, please see Configuring Index|
|QueryError [sql_illegal_argument_exception.cannot cast [13/Jul/2021:17:04:34] to [datetime]: failed to parse date field [13/Jul/2021:17:04:34] with format [date_optional_time]]||`cast` cannot convert dates in `13/Jul/2021:17:04:34` format. Only ISO standard format and millisecond-level Unix timestamp are supported, e.g. ||Modify the format of the time field or use the
|QueryError [verification_exception.Cannot order by non-grouped column [xxx], expected [xxx] or an aggregate function||Statistics is not enabled for the field `xxx` and thus it cannot be used for sorting||Enable statistics for this field. For details, please see Log Analysis Overview|
|QueryError [verification_exception.Cannot use non-grouped column [xxx], expected [xxx]]||Statistics is not enabled for the query field `xxx`||Enable statistics for this field. For details, please see Log Analysis Overview|
|QueryError [verification_exception.Field [xxx] of data type [text] cannot be used for grouping]||Statistics is not enabled for the field `xxx` and thus it cannot be used for grouping||Enable statistics for this field. For details, please see Log Analysis Overview|
|QueryError [verification_exception.Unknown column [xxx]]||The query field `xxx` does not exist||Check whether the field name is correct|
|SyntaxError[xxx]||There is a syntax error in part of the SQL statement||Please see the detailed tips in the error message to fix the syntax error, where |
|SearchTimeout||The query is timed out||Reduce the scope of data query and SQL complexity as appropriate, or try again later.|
|LimitExceeded.LogSearch||The search concurrency exceeds the limit||Try again later|