Log Field Reference

CloudBase logs are stored as key-value records, and each log consists of several fields. This page describes the log sources, field meanings, and types, and how to write them in search statements. Use it when you write search statements, configure indexes, or set up alerts.

Log Sources

Logs produced by different resources are distinguished by different search conditions:

Log source	Search condition	Description
Cloud functions	function_name:"function-name"	Function runtime logs, including system logs and user code logs
CloudRun	Select CloudRun in the console; use --service tcbr in the CLI	Container standard output logs
Gateway access	logType:accesslog	HTTP access logs
Document database	module:database	Database operation logs
SQL database	module:rdb	SQL database event logs
Data model	module:model	Data model logs
User authentication	module:auth	Sign-in and authentication events
Large language model	module:llm AND logType:llm-tracelog	AI invocation tracing
WeDa application	module:app	WeDa application publish and delete events

Common System Fields

Platform logs carry the following system fields by default:

Field	Type	Description
level	string	Log level: log, info, warn, or error
requestId	string	Request ID, used to correlate logs of the same request
module	string	Module name, matching the modules in "Log Sources" above
resourceName	string	Resource name, identifying the resource the request actually accessed
errorCode	string	Error code
errorMessage	string	Error message
request	string	Request parameters
response	string	Response parameters
msg	string	Simple log content; not a default field
user	string	User identifier
src	string	Log source: system for system logs, app for user code logs
startTime	string	Request start time
timeCost	string	Request duration, in milliseconds
service	string	The service that was called

Cloud Function Log Fields

Cloud function logs contain the following fields:

Field	Description	Example
function_name	Function name	function_name:"user-login"
function_id	Function ID	function_id:"lam-xxxxxxxx"
request_id	Unique ID of the invocation	request_id:"abc123"
qualifier	Function version	qualifier:"$LATEST"
alias	Function alias	alias:"prod"
status	Invocation status
status_code	Invocation status code: 200 for success, 202 for an intermediate state	status_code>200 AND status_code!=202
status_msg	Invocation status message
ret_code	Return code
ret_msg	Return message
src	Log source: system for system logs, app for user code logs	src:app
log	Log body	log:"Error"
log_size	Log size
duration	Execution duration, in milliseconds	duration:>5000
bill_duration	Billed duration
memory	Memory usage	memory:512
mem_usage	Memory usage amount
mem_duration	Memory duration
function_invoke_time	Function invocation time
function_invoke_end_time	Function invocation end time
start_time	Invocation start time
event_type	Invocation type
request_source	Request source, for example TRIGGER_TIMER for a timer trigger	request_source:TRIGGER_TIMER
retry_num	Retry count; use retry_num=0 to filter out retried requests	retry_num=0
caller, caller_ip	Caller and its IP
report_ip	Report IP
wan_traffic	Public network traffic
cluster_name	Cluster name
container_id	Container ID
user_id	User ID	user_id:"1307589412"
namespace	Environment ID	namespace:"my-env"
stamp	Invocation stamp
tcb_log	Additional CloudBase log
@timestamp	Log timestamp

Note

The request ID field of cloud function logs is request_id, while other logs use requestId. Always use request_id when you search cloud function logs or write SQL analysis statements for them.

CloudRun Log Fields

Field	Description	Example
__CONTENT__	Log content, used for full-text search	"error" AND "timeout"
__TAG__.container_name	Container name, in the format of service name plus instance name; regular expressions are supported	/servername-[0-9]+/
__TAG__.pod_name	Instance name in the cluster	__TAG__.pod_name:"xxx"
__TAG__.pod_uid	Instance UID in the cluster
__TAG__.pod_ip	Instance private IP in the cluster
__TAG__.pod_label_k8s-app	Service name and instance version
__TAG__.pod_label_pod-template-hash	Template hash
__TAG__.image_name	Image name
__TAG__.cluster_id	Cluster ID
__TAG__.namespace	Instance namespace in the cluster
__TAG__.envId	Environment ID
__TAG__.stream	Log collection source

Gateway Access Log Fields

Gateway access logs are filtered with logType:accesslog. Fields:

Field	Type	Description	Example
logType	string	Log type	accesslog
statusCode	string	Response status code	"200", "502"
code	string	Service call error code
message	string	Error message
host, matchedHost	string	Requested domain name	xxx.api.tcloudbasegateway.com
path, url	string	Request path, request URL	/auth/v1/certs
query	string	Query parameters
method, action	string	HTTP request method	GET
module	string	Backend module that handled the request	auth
resourceName	string	Resource actually accessed by the request; empty for authentication APIs	PostgresREST
timeCost	string	Request duration, in milliseconds	26
startTime, startAt, endAt	string	Request start and end time
timestamp	string	Timestamp
sourceIp, xff	string	Source IP, X-Forwarded-For header	175.24.212.162
requestId, logId	string	Unique request identifier, used to look up a single request	9be5592e-11ea-4f45-9c83-e44ff20e7ed4
level	string	Log level	info
accessSource	string	Access source	http_openapi
source	string	Source identifier
reqSize, resSize	string	Request body and response body size
contentType	string	HTTP Content-Type
origin	string	HTTP Origin
referrer	string	HTTP Referrer
userAgent	string	HTTP User-Agent
secchua	string	HTTP Sec-Ch-UA
sdkVersion	string	SDK version
version	string	Version
userId	string	User ID
userType	string	User type
authMethod	string	Authentication method
isAdministrator	string	Whether the call is made as an administrator
upstream.type	string	Upstream type, for example database
upstream.requestId	string	Upstream request ID
upstream.status	string	Upstream status code
upstream.timeCost	string	Upstream duration

A sample gateway access log:

{
  "logType": "accesslog",
  "statusCode": "200",
  "host": "xxx.api.tcloudbasegateway.com",
  "path": "/auth/v1/certs",
  "method": "GET",
  "module": "auth",
  "timeCost": "26",
  "requestId": "9be5592e-11ea-4f45-9c83-e44ff20e7ed4",
  "sourceIp": "175.24.212.162"
}

statusCode is a string. Write it as statusCode:"502" in searches.

Document Database Log Fields

Document database logs are filtered with module:database. They include the request fields of gateway access logs (host, path, method, statusCode, requestId, timeCost, sourceIp, userId, upstream.*, and so on), plus the following fields:

Field	Description
msg	Log content
resourceName	Resource
action	Operation
query	Query parameters
code	Error code
isAdministrator	Whether the call is made as an administrator

SQL Database Log Fields

SQL database logs are filtered with module:rdb:

Field	Description
msg	Log content
action	Operation
result	Execution result
schema	Database
table	Table name
latencyMs	Duration, in milliseconds
requestId	Request ID
envId	Environment ID
appId	Application ID
uin	User UIN
module	Module
timestamp	Timestamp

User Authentication Log Fields

User authentication logs are filtered with module:auth:

Field	Description
level	Log level
requestId	Request ID
request, response	Request and response
clientId	Client ID
deviceId	Device ID
user	User
host	Host
origin	Origin header
referer	Referer header
error	Error type
errorCode	Error code
errorMessage	Error message
timeCost	Duration
startTime	Start time
timestamp	Timestamp
module	Module

Large Language Model Log Fields

Large language model tracing logs are filtered with module:llm AND logType:llm-tracelog:

Field	Description
modelProvider	Model group
model	Model name
input	Request content
output	Response content
stream	Whether the call is streaming
maxTokens	Maximum output tokens specified in the request
promptTokens	Input tokens
completionTokens	Output tokens
totalTokens	Total tokens
firstTokenDuration	Interval to the first token, in milliseconds
timeCost	Duration, in milliseconds
statusCode	HTTP status code
startTime	Request start time
user	User ID
requestId	Unique request identifier
traceId, spanId	Trace IDs
logType	Log type
module	Module name

WeDa Application Log Fields

WeDa application logs are filtered with module:app:

Field	Description
msg	Log content
requestId	Request ID
module	Module
eventType	Event type; see "Platform Event Types" below for values
resourceName	Resource name
timestamp	Timestamp

Platform Event Types

Some platform logs identify events with the eventType field. You can combine it with module to filter:

Module	eventType values	Description
database	MongoSlowQuery	Document database slow queries
rdb	MysqlSlowQuery, MysqlFreeze, MysqlRecover	SQL database slow queries, freeze, and recovery
app	AppProdPub, AppProdDel	WeDa application publish and delete

Limits

• After the log content is split by token delimiters, a single token cannot exceed 32 KB.
• A key-value index only applies to logs written after the index is modified. Historical logs are not re-indexed.
• Only fields with a key-value index can be used in SQL analysis statements.

Viewing Log Fields

• Console: In CloudBase Platform/Log Monitoring/Log Management, expand a log to view all its fields. Use the column settings in the upper-right corner to adjust the displayed fields.
• CLI: Run tcb logs search --json. The result contains all fields of each log. See CLI Log Search for details.

Related Documentation

• Log Search: Syntax for full-text, key-value, and fuzzy search.
• Log Alert Guide: Configure alerts based on log fields.