Tencent Cloud Log Service (CLS) Query and Analysis Guide.
Rules
- String values in CQL MUST be quoted:
level:"ERROR"notlevel:ERROR - ALWAYS specify topic when searching — CLS requires a topic context
- SQL analysis only works when the topic has "统计分析" enabled; an empty result may mean
Analysis: false - Use
cast(__TIMESTAMP__ as timestamp)for time operations in SQL analysis
CQL Quick Reference
key:"value" # 键值搜索(字符串必须加引号)
key:123 # 数值搜索
value # 全文搜索
level:"ERROR" AND pid:1 # 逻辑与
status:>400 # 范围查询
host:*test* # 通配符
field:* # 字段存在
NOT key:"value" # 排除
AND has higher precedence than OR; it is recommended to use parentheses to make it explicit:
(A OR B) AND C
MCP Tool Quick Reference
| Tool | Purpose | Key Parameters |
|---|---|---|
search |
Search logs | topic, query, from, limit, format |
cluster_logs |
Cluster similar logs | topic, query, field, simTh |
log_context |
Get log context | topic, time, pkgId, pkgLogId |
histogram |
Time distribution statistics | topic, query, from, buckets |
# 搜索日志
mcp-cli call <cls-server>/search '{"topic":"my-topic","query":"level:\"ERROR\"","from":"-6h","limit":50}'
# 聚类分析
mcp-cli call <cls-server>/cluster_logs '{"topic":"my-topic","query":"level:\"ERROR\"","from":"-3d"}'
# 日志上下文
mcp-cli call <cls-server>/log_context '{"topic":"my-topic","time":"...","pkgId":"...","pkgLogId":"..."}'
# 时间分布
mcp-cli call <cls-server>/histogram '{"topic":"my-topic","from":"-24h","buckets":24}'
SQL Analysis
-- 格式: <CQL过滤> | SELECT ...
* | SELECT count(*) as total, count(distinct remote_addr) as uv
GROUP BY date_trunc('minute', __TIMESTAMP__)
ORDER BY time LIMIT 10000
References
- references/cql-syntax.md — Detailed explanation of CQL search syntax, time format, troubleshooting log parsing failures
- references/sql-analysis.md — SQL analysis syntax, common functions, analysis examples
- references/mcp-tools.md — Complete parameters of CLS MCP tools, response format, CLI configuration