All Products
Search
Document Center

Simple Log Service:How do I resolve common errors that may occur when I query and analyze logs?

最終更新日:Aug 02, 2023

This topic describes the common error messages that may be returned when you query and analyze logs in the Simple Log Service console and provides solutions to the errors.

line 1:44: Column 'XXX' cannot be resolved;please add the column in the index attribute

  • Cause

    No index is configured for the XXX field.

  • Solution

    Configure an index and enable the log analysis feature for the field. For more information, see Create indexes.

ErrorType:QueryParseError.ErrorMessage:syntax error error position is from column:10 to column:11,error near < : >

  • Cause

    The syntax of the query statement is invalid. The position of the invalid syntax is near the colon (:).

  • Solution

    Check and modify the query statement, and execute the new query statement.

Column 'XXX' not in GROUP BY clause;please add the column in the index attribute

  • Cause

    If you use the GROUP BY clause in an analytic statement, the system can query only a column that is included in the GROUP BY clause or perform aggregation on an arbitrary column when the system executes the SELECT statement. For example, * | SELECT status, request_time, COUNT(*) AS PV GROUP BY status is an invalid analytic statement because request_time is not a GROUP BY column.

  • Solution

    Modify the query statement and execute the new query statement. In contrast to the preceding query statement, the following query statement is valid: * | SELECT status, arbitrary(request_time), count(*) AS PV GROUP BY status. For more information, see GROUP BY clause.

sql query must follow search query,please read syntax doc

  • Cause

    Only an analytic statement is specified. In Simple Log Service, an analytic statement must be used together with a search statement in the Search statement|Analytic statement format.

  • Solution

    Add a search statement prior to the analytic statement. Example: * | SELECT status, count(*) AS PV GROUP BY status. For more information, see Syntax.

line 1:10: identifiers must not start with a digit; surround the identifier with double quotes

  • Cause

    The syntax of the analytic statement is invalid because a column name or variable name that is specified in the analytic statement starts with a digit. In compliance with SQL standards, a column name that is specified in an analytic statement can contain letters, digits, and underscores (_) and must start with a letter.

  • Solution

    Change the alias. For more information, see Column aliases.

line 1:9: extraneous input ‘’ expecting

  • Cause

    Extra Chinese quotation marks are specified in the query statement.

  • Solution

    Check and modify the query statement, and execute the new query statement.

key (XXX) is not config as key value config,if symbol : is in your log,please wrap : with quotation mark "

  • Cause

    No field index is configured for the XXX field, or the field that you specify contains special characters such as spaces but is not enclosed in double quotation marks ("").

  • Solution

    1. Check whether a field index is configured for the field and whether the log analysis feature is enabled for the field.

      • If yes, proceed to the next step.

      • If no, configure field indexes and enable the log analysis feature for the field. For more information, see Manually create field indexes.

        If the error is resolved, skip the next step.

    2. Enclose the field in double quotation marks ("").

Query exceeded max memory size of 3GB

  • Cause

    The size of the memory that is used by the query statement exceeds 3 GB. The error occurs because a large number of values are returned in the query and analysis results after you use a GROUP BY clause to remove duplicates.

  • Solution

    Optimize the GROUP BY clause. Reduce the number of fields that are specified in the GROUP BY clause.

ErrorType:ColumnNotExists.ErrorPosition,line:0,column:1.ErrorMessage:line 1:123: Column 'XXX' cannot be resolved; it seems XXX is wrapper by ";if XXX is a string ,not a key field, please use 'XXX'

  • Cause

    XXX is not an indexed field and cannot be enclosed in double quotation marks (""). If you want to use a string in an analytic statement, you must enclose the string in single quotation marks (''). Strings that are not enclosed or enclosed in double quotation marks ("") indicate field names or column names.

  • Solution

    • If XXX is a field that you want to analyze, make sure that you configure an index and enable the log analysis feature for the field. For more information, see Create indexes.

    • If XXX is a string, you must enclose the string in single quotation marks ('').

user can only run 15 query concurrently

  • Cause

    More than 15 analysis operations are concurrently executed. Each project supports up to 15 concurrent analysis operations.

  • Solution

    Reduce the number of concurrent analysis operations based on your business requirements.

unclosed string quote

  • Cause

    The double quotation marks (") in the query statement are incomplete.

  • Solution

    Check and modify the query statement, and execute the new query statement.

error after :.error detail:error after :.error detail:line 1:147: mismatched input 'in' expecting {<EOF>, 'GROUP', 'ORDER', 'HAVING', 'LIMIT', 'OR', 'AND', 'UNION', 'EXCEPT', 'INTERSECT'}

  • Cause

    The invalid keyword in is specified.

  • Solution

    Check and modify the query statement, and execute the new query statement.

Duplicate keys (XXX) are not allowed

  • Cause

    Duplicate indexes are configured for fields.

  • Solution

    Check the index configurations. For more information, see Create indexes.

only support * or ? in the middle or end of the query

  • Cause

    Wildcard characters are not used at the expected positions when you perform a fuzzy search.

  • Solution

    Modify the wildcard characters in the query statement. Take note of the following items:

    • You can add an asterisk (*) or a question mark (?) as a wildcard character to the middle or end of a keyword to perform a fuzzy search.

    • You cannot add an asterisk (*) or a question mark (?) to the start of a word.

    • Asterisks (*) or question marks (?) are not supported in fuzzy searches for data of the long or double type.

logstore (xxx) is not found

  • Cause

    The XXX Logstore does not exist or has no indexes configured.

  • Solution

    Check whether the Logstore exists. If the Logstore exists, you must configure indexes for at least one field and enable the log analysis feature for the field.

condition number 43 is more than 30

  • Cause

    The number of fields that are specified in the search statement is 43. A maximum of 30 fields can be specified in a search statement.

  • Solution

    Modify the search statement and make sure that the number of fields is less than or equal to 30.

ErrorType:SyntaxError.ErrorPosition,line:1,column:19.ErrorMessage:line 1:19: Expression "data" is not of type ROW

  • Cause

    The data type of a field that is specified in the query statement is invalid.

  • Solution

    Check and modify the query statement, and execute the new query statement.

ErrorType:SyntaxError.ErrorPosition,line:1,column:9.ErrorMessage:line 1:9: identifiers must not contain ':'

  • Cause

    The field that you want to analyze contains colons (:).

  • Solution

    Enclose the field in double quotation marks (""). For example, if you want to analyze the __tag__:__receive_time__ field, you can use the following statement: *| select "__tag__:__receive_time__".

    Important

    Before you can analyze a field, you must create indexes for the field. For more information, see Manually create field indexes.

No nodes available to run query

  • Cause

    An internal error occurred.

  • Solution

    Refresh the page and execute the query statement again.