alicloud-observability-sls-log-query

What This Skill Does

The alicloud-observability-sls-log-query skill provides an interface for interacting with Alibaba Cloud Log Service (SLS) using its native query and analysis syntax. It allows the AI agent to retrieve, filter, and perform complex statistical aggregations on log data stored in SLS. By leveraging the Python SDK, this skill enables automated root-cause analysis, error trend monitoring, and performance investigation across your cloud infrastructure. Whether you need to filter logs by status code, perform group-by aggregations for traffic analysis, or extract specific log entries from a defined time window, this skill bridges the gap between raw cloud telemetry and actionable insights.

Installation

To use this skill, ensure you have a Python 3 environment ready. Run the following command via ClawHub: clawhub install openclaw/skills/skills/cinience/alicloud-observability-sls-log-query

After installation, ensure the following environment variables are set:

• ALIBABA_CLOUD_ACCESS_KEY_ID & ALIBABA_CLOUD_ACCESS_KEY_SECRET: Your credentials for Alibaba Cloud.
• SLS_ENDPOINT: The API endpoint for your region (e.g., cn-hangzhou.log.aliyuncs.com).
• SLS_PROJECT & SLS_LOGSTORE: The identifiers for your specific log storage destination.

Use Cases

• Production Troubleshooting: Quickly isolate logs containing '500' or '404' status codes during an active incident.
• Performance Monitoring: Aggregate request latency metrics or error counts over the last hour using SQL-like analysis syntax.
• Security Auditing: Extract access logs to identify suspicious IPs or failed login attempts.
• Automated Reporting: Periodically query specific log fields to generate summaries of application activity.

Example Prompts

• "Search for all logs in the last 15 minutes that contain an HTTP 500 error code."
• "What is the distribution of status codes for my service in the last hour? Run an analysis query to group by status."
• "Troubleshoot the latest service logs and list the top 20 entries where the error field is present."

Tips & Limitations

• Indexing: Always ensure your target Logstore has index fields configured. Without proper indexing, query and analysis operations will fail or behave unpredictably.
• Time Windows: Large time ranges can lead to performance degradation or timeout errors. Always use the --last-minutes or explicit start and end arguments to narrow your scope.
• SDK Limits: The tool uses limit to throttle the output. Be mindful of this when querying high-traffic logs to avoid excessive data extraction overhead. Always refer to references/query-syntax.md for supported SQL-like commands.