Why cannot any logs be retrieved when the search bar is empty?
When the search bar is empty, it means that there are no filter conditions and all logs can be searched. In case of a search failure, use the following methods for troubleshooting.
1. Select a larger time range (e.g., the last 30 days), keep the search statement empty, and determine whether there are logs..
2. No logs:
The index may not be enabled for the current log topic. Enable the index for this topic in Index Configuration. The index may not have been enabled when the logs were reported, but was enabled after the reporting ended. Reindex the historical data in Rebuild Index, or recollect the logs after enabling the index. The logs may not be reported. When you are using LogListener to collect logs, check the machine group status shows any exceptions. When you are using SDK to report logs, check whether there are errors in the output log of SDK itself. The log time may be incorrect, and logs are reported to a future time or a time that exceeds the storage duration of the log topic. When you are using LogListener to collect logs, check whether the server time where the logs are located is correct. If you are using a custom log time, check whether the time format is configured correctly. When you are using SDK to report logs, check whether the log time parameter is passed correctly. 3. Logs are available in some periods, and unavailable at other timesLogs available for some time periods, no logs for other time periods:
The logs may not be reported. When you are using LogListener to collect logs, check the machine group status shows any exceptions. When you are using SDK to report logs, check whether there are errors in the output log of SDK itself. There may be no logs during this period. Check whether your business generates logs during the specified period.
Logs can be retrieved when the search bar is empty. Why cannot any logs be retrieved after the search statement is entered?
There are several possible causes of this problem.
Some logs are reported unsuccessfully: When you are using LogListener to collect logs, check the machine group status shows any exceptions. When using SDK to report logs, check whether there are errors in the output log of SDK itself. Incorrect segment in index configuration: Retrieval is based on segmenting logs. The original log must contain the word specified in the search condition after segmentation to be retrieved. For example, errorMessage cannot be searched if you search error because errorMessage is a word not equal to error. To search the log, the wildcard error* is required. For more explanations and examples of segmentation, see Segment and Index. Historical logs are not configured with the latest index settings: After you modify index configurations, they only take effect on newly collected logs. You can check the last index modification time on the Index Configuration page. If the log to be searched is before that time, you may not be able to search the historical log with the current index configuration. Reindex the historical data in Rebuild Index. When you are using LogListener to collect logs, some logs are parsed abnormally in the collection phase and stored under the LogParseFailure field. Try full-text search or use Key-Value search (Key-Value index needs to be enabled for LogParseFailure) for the LogParseFailure field.
Some logs encounter exceptions during index creation and are stored under the __RAWLOG__ field. Try full-text search. Logs can be searched by using the log service console. Why cannot they be searched by using API?
This problem is caused by incorrect API parameters. We recommend that you use the browser developer tools on the CLS console page to check the request parameters of the interface and verify whether they are consistent with the parameters you use when calling the API. The most common issue is that the Unix timestamp unit for the From and To parameters of the SearchLog interface is incorrect. You should use Unix timestamps in milliseconds, and timestamps in seconds are not supported.