How to Perform Cross‑Project Log Queries with Alibaba Cloud SLS StoreView

Overview

SLS (Log Service) provides large‑scale, low‑cost, real‑time log, metric, and trace storage. While it supports multi‑region projects, it cannot query across projects directly. StoreView was introduced to combine logstores from multiple projects into a virtual logstore, enabling cross‑project queries, data isolation, enrichment, and alignment.

Data Preparation

Two test projects in different regions are used, each with slightly different schemas (different UnitsSold types and pricing fields). The datasets are intentionally mismatched to illustrate StoreView handling of schema differences.

Creating a StoreView

Define a StoreView (e.g., all_market_data) in any region that supports StoreView. After creation, the virtual logstore behaves like a regular logstore for queries.

Querying Across Projects

Running a query against the StoreView returns combined results from both projects, matching expectations as shown by log entry counts and histogram charts.

Data Isolation

StoreView allows per‑account access control. For example, a sub‑account can be restricted to only data where Country='China' by adding a WHERE clause in the StoreView definition, effectively isolating data without granting full logstore access.

Data Enrichment

Using SPL where and extend operators, additional fields such as logstoreName can be added to the result set, providing context about the source logstore. The extend fields are dynamic and cannot be used for filtering.

Analysis with StoreView

SQL analysis on a StoreView works the same as on a regular logstore. Meta columns __project__ and __logstore__ are automatically provided, allowing filtering or grouping by source project or logstore.

Column Type Compatibility

If columns with the same name have different types across logstores (e.g., UnitsSold as long vs text), the service coerces the column to text. Users must cast the column to the appropriate type (e.g., CAST(UnitsSold AS BIGINT)) for aggregation functions.

Automatic Column Completion

When logstores have differing column sets, StoreView includes the union of all columns. Missing columns in a particular logstore are filled with NULL, ensuring a consistent schema across the virtual logstore.

Column Extension and Processing

To unify revenue columns with different currencies, SPL can create a new column TotalRevenue that converts TotalRevenueUsd and TotalRevenueRmb to a common unit. Subsequent SQL queries can then aggregate TotalRevenue by region with a simplified statement.

Conclusion

StoreView dramatically simplifies cross‑region, cross‑project log analysis by eliminating the need for data replication tasks, reducing storage and network costs, and providing flexible data isolation and enrichment capabilities. Users should be aware of potential network latency when querying across domains, and future improvements aim to enhance stability and performance.