• Explain, rewrite, optimize or execute an existing query
• Translate a natural-language requirement into an SLS index query, SQL, or SPL statement

aliyun configure list

aliyun configure

• NEVER read, echo, or print AK/SK values
• NEVER ask the user to paste AK/SK into the conversation
• ONLY use

  aliyun configure list

  to check credential status

get-logs-v2

log:GetLogStoreLogs

get-index

log:GetIndex

Permission failure handling: If a call returns

Unauthorized

permission error, stop and surface references/ram-policies.md to the user. Do not retry with a different account without explicit user confirmation.

1. Read index configuration (GetIndex)
2. Pick query mode
3. Build statement
4. Resolve time range
5. Execute query
6. Extract data from response
7. Present CLI command and results

get-index

aliyun sls get-index \
  --project <project> --logstore <logstore>

line

keys

{ type, doc_value, token, caseSensitive, chn, ... }

doc_value: true

IndexConfigNotExist

line

keys

• The response can be large — extract only the fields relevant to the current query. Cache per

  logstore

  and reuse within the session.

get-index

<index-search>

line

keys.<field>

<index-search> | <SQL>

GROUP BY

keys.<field>

doc_value: true

<index-search> | <SQL scan>

<index-search> | <SPL>

• Always prefer Index search for fastest speed.
• Use Index search + SQL when the user needs analytical operations or field projection rather than full raw-log retrieval, such as aggregation,

  GROUP BY

  , sorting, window analysis, top-N, or returning only the required fields/columns.
• Do not proactively choose SQL scan or SPL; use them only when the user explicitly requests.

|

*

* and "payment failed" and status: "500" and not path: "/healthz"

• *

  matches all;

  "..."

  is full-text (needs full-text index).

• key: "value"

  is a field filter (needs field index).
• Combine with

  and

  /

  or

  /

  not

  ; group with parentheses.

• key: *

  means field exists. Range (

  >

  ,

  >=

  ,

  [a, b]

  ) works only on

  long

  /

  double

  .

status: 500 | SELECT date_trunc('minute', __time__) AS minute,
                    count(*) AS errors
              FROM log
              GROUP BY minute
              ORDER BY minute

• Read references/query-analysis.md for Query & SQL rules
• Table name is

  log

  (recommended to omit).
• SQL respects the indexed field type from

  get-index

  — a

  long

  /

  double

  field can be compared directly (

  status >= 500

  ). Cast only when a field is indexed as

  text

  but numeric semantics are needed (

  try_cast

  to suppress errors).
• Read references/functions-guide.md for unusual Function selection (aggregate, JSON, regex, datetime, IP geo …)

--from

--to

--from

--to

1. Relative time — user says "recent / last N minutes|hours|days".
2. Natural-language absolute time without timezone — normalize to

   YYYY-MM-DD HH:MM:SS

   , then parse using the machine's local timezone.
3. Absolute time with explicit timezone — parse using the customer-provided timezone or UTC offset.

undefined

aliyun sls get-logs-v2

aliyun help sls get-logs-v2

• --project

  : SLS project name

• --logstore

  : Logstore name within the project

• --from

  : Start of time range, Unix timestamp in seconds (inclusive)

• --to

  : End of time range, Unix timestamp in seconds (exclusive)

• --query

  : Statement built in Step 3

|

aliyun sls get-logs-v2 \
  --project my-project --logstore my-logstore \
  --from 1740000000 --to 1740003600 \
  --query '* and "payment failed" and status: "500"' \
  --line 100 --offset 0 --reverse true

• Pagination:

  --line

  is page size (

  1–100

  , required);

  --offset

  is the start row (optional, default

  0

  ).
• Ordering:

  --reverse true

  returns newest first; default

  false

  is oldest first.

aliyun sls get-logs-v2 \
  --project my-project --logstore my-logstore \
  --from 1740000000 --to 1740003600 \
  --query 'status: "500" | SELECT request_uri, count(*) AS cnt FROM log GROUP BY request_uri ORDER BY cnt DESC LIMIT 20'

• SQL default result cap is 100 rows. To get more results or paginate:

  • LIMIT count

    — raise the cap (e.g.,

    LIMIT 500

    returns up to 500 rows)

  • LIMIT offset, count

    — paginate (e.g.,

    LIMIT 20, 20

    for rows 21–40;

    LIMIT 40, 20

    for rows 41–60). Max offset+count is 1000000.
  • Do not use

    LIMIT count OFFSET offset

    syntax — it is not supported. Always use

    LIMIT offset, count

    .
• Ordering: use

  ORDER BY <field> DESC/ASC

  to sort.

meta.progress

Incomplete

Complete

• Always prefer Index search for fastest raw-log retrieval, and use Index search + SQL for analysis or field projection.
• When the user only needs specific fields, use

  SELECT

  to project them rather than fetching full raw logs — this reduces network overhead. Requires

  doc_value: true

  on the target fields (confirmed in Step 1).
• Do not hard-code

  __time__

  filters — pass time range via

  --from

  /

  --to

  .
• Deprecated API: never call

  get-logs

  ; always use

  get-logs-v2

  .

1. Time range — wrong

   --from

   /

   --to

   ? Milliseconds instead of seconds? Recent writes still indexing?
2. Index configuration — field index missing? Full-text index off? Target field not in

   keys

   ?
3. Field type / statistics — range query on a

   text

   field? SQL on a field without

   doc_value

   ?
4. Syntax — mixed SQL and SPL? Leading

   *

   in fuzzy match? SPL string escaping?
5. Mode choice — scanning when an index-based query would do? Aggregating in SPL instead of SQL?
6. Completeness —

   meta.progress = Incomplete

   , caller did not retry (see Step 5).
7. ProjectNotExist — region or endpoint is wrong. See references/regions.md.
8. Network failure (timeout, connection refused) — try switching to internal endpoint. See references/regions.md.

Common Errors