How is SLS query syntax different from Elasticsearch?

SLS uses a hybrid syntax — plain-text search before the `|` and SQL after. So 'status:500 | SELECT COUNT(*) FROM log' filters logs to those with status 500 then counts them. It's more SQL-fluent than Elasticsearch's DSL, simpler for engineers who already know SQL, but less flexible for very complex aggregations.

Can SLS forward logs to other systems?

Yes — SLS supports shipper rules to OSS (for archive), MaxCompute (for analytics), or external systems via HTTP webhook. For long-term storage, OSS archival is dramatically cheaper than SLS native retention.

Alibaba Log Service Query Builder

MonitoringAlibaba Cloud

Build SLS log queries with SQL analytics, alert configurations, dashboards, and notification channels.

Last verified: May 2026

Alibaba Cloud SLS Query

Project

Logstore

Query (Search + Analytics SQL)

From Time

To Time

Topic (optional)

Line (limit)

Offset

Reverse

Output Format

Project is required
Logstore is required

Generated SLS Query Config

Output will appear here...

About This Tool

Alibaba Cloud Log Service (SLS) is the managed log aggregation platform — projects contain logstores, queries use a SQL-like syntax with full-text and field-based filtering, alerts run on saved queries, and dashboards aggregate views. The SLS Query Builder generates query definitions, saved queries, alerts, exclusion rules, and archiving configurations. Output is YAML-ready for the SLS API.

Real-World Scenario

SLS ingestion has climbed to a meaningful monthly cost. You audit by source and find health-check probes account for 35% of ingestion. Adding exclusion rules at the agent level drops next month's bill by a third. You also build saved queries for the top error patterns so on-call doesn't need to remember syntax during incidents.

When to Use This Tool

•Building alerts for known error patterns (5xx response codes, ERROR log lines) with reasonable thresholds.
•Configuring archive rules so logs older than 30 days move to cheap OSS storage instead of consuming retention budget in SLS.
•Saving frequently-used queries as named queries so the on-call team has consistent starting points for incident response.
•Excluding low-value logs (health-check probes, expected debug output) to reduce ingestion cost.

Pro Tips

TIP

Tag log lines with structured fields (service, env, request_id) at the application layer. Unstructured logs are slow to query and produce vague aggregations.

TIP

Set alert sensitivity to match operational tolerance for false alarms. Alerts on a single error log line burn out on-call; alerts requiring 50+ errors in 5 minutes catch real problems without noise.

How It Works Under the Hood

The builder collects SLS project, logstore, query definitions (full-text + SQL), saved query names, alert thresholds, exclusion rules, and archive bucket configuration. Output is JSON for the SLS API plus a Terraform block for the project/logstore configuration. Alerts and archive rules are emitted as additional resources.

Frequently Asked Questions

How is SLS query syntax different from Elasticsearch?: SLS uses a hybrid syntax — plain-text search before the `|` and SQL after. So 'status:500 | SELECT COUNT(*) FROM log' filters logs to those with status 500 then counts them. It's more SQL-fluent than Elasticsearch's DSL, simpler for engineers who already know SQL, but less flexible for very complex aggregations.
Can SLS forward logs to other systems?: Yes — SLS supports shipper rules to OSS (for archive), MaxCompute (for analytics), or external systems via HTTP webhook. For long-term storage, OSS archival is dramatically cheaper than SLS native retention.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.