Master Logs with Natural Language: Alibaba Cloud SLS Agent Skills Guide

Over the past year, Alibaba Cloud Log Service (SLS) has continuously improved its CLI and Agent Skills, integrating log collection, analysis, and monitoring capabilities into agent workflows. Users can describe business goals in natural language, and the agent collaborates to complete log ingestion, monitoring setup, and fault diagnosis, reducing manual configuration, command writing, and repetitive queries.

SLS currently offers 8 skills covering the complete log lifecycle from generation to consumption: SDK integration, log collection, logstore creation, index configuration, query and analysis, alerting, visualization, and root cause analysis. Each skill supports on-demand installation and uses progressive context disclosure, loading relevant instructions only when needed to minimize context overhead.

Scenario Example: One-Sentence Codex Usage Monitoring

For Codex usage monitoring, the goal is to understand token consumption, track remaining weekly quota, and receive notifications when the quota resets. The requirement can be expressed as a single prompt to the agent:

Help me write a script to collect local Codex token consumption (including input, output, cached details) and current quota usage (scheduled reporting), use aliyun cli to report to SLS project xxxx, create corresponding logstore and index configuration, then create a dashboard with daily/weekly token consumption stats, quota consumption curve, token consumption by dimension, and finally configure an alert to email [email protected] when Codex weekly quota resets.

The agent automatically executes several interconnected steps:

Collection and Reporting : Write token usage and quota snapshots to the token-usage logstore, continuously recording consumption, remaining quota, and reset time.

Create Logstore and Configure Index : Create the corresponding logstore, configure indexes and statistical capabilities for token count, quota percentage, and time fields, enabling direct query and analysis.

Build Dashboard : View token consumption by model, project, and session; observe usage trends; understand which tasks consume quota.

Configure Alert Email Notification : Periodically query weekly quota records, identify quota resets, and send email when conditions are met.

Recommended to combine with browser-use, browser-act, chrome-use, playwright, agent-browser skills or tools that control browsers, allowing the agent to verify and adjust dashboard display details for better visual results.

The article includes screenshots of the agent-created dashboard and the alert email received at quota reset.

Installation and Usage

Skills are installed via npx and require Node.js. Each skill installation command follows the pattern:

npx -y skills add aliyun/alibabacloud-aiops-skills --skill <skill-name> -y --full-depth

1. alibabacloud-sls-query

Online query and analysis of SLS logs, supporting SLS query syntax, SQL, and SPL; generates and optimizes query statements. Supports field-based log retrieval, error counting, interface ranking, and latency trend analysis.

Scenario 1: Top 10 Error Interfaces

Query cn-hangzhou prod-web/nginx-access, count 500 requests per request_uri in the past hour, list top 10 error interfaces, provide query statement and statistical results.

Scenario 2: Compare Latency Trends

Analyze average latency change between the last hour and same period yesterday for prod-web/nginx-access, statistics by minute.

2. alibabacloud-loongcollector-ops

Install/upgrade Logtail/LoongCollector on ECS, Linux hosts, ACK, or self-managed Kubernetes

Manage collection configurations, machine groups, and bindings

Troubleshoot no-data collection and machine group heartbeat anomalies

Supports host log collection access, collection configuration adjustment, and basic fault diagnosis.

Scenario 1: Host Log Ingestion

Install LoongCollector on ECS i-example in cn-hangzhou, collect /var/log/nginx/access.log to prod-web/nginx-access, configure machine group and binding, verify logs queryable in SLS.

Scenario 2: Troubleshoot No Data Collection

prod-web/nginx-access in cn-hangzhou has no new logs recently. Check associated collection config, machine group binding, and member heartbeats; identify anomaly location and handling suggestions.

3. alibabacloud-sls-agent-workflow

Select and combine skills based on task to complete resource creation, log collection, query analysis, and alert configuration. Supports combined tasks from logstore and index creation to log writing and query verification.

Scenario: Complete Log Write and Query

In cn-hangzhou create Project=demo-sls and Logstore=app-logs, configure indexes for level, service, message, write several test logs, then query ERROR logs and count by service to verify write and query results.

4. alibabacloud-sls-alerting

Create and adjust alert rules, manage notification channels, recipients, and policies; support enable/disable, silence, and alert noise reduction. Combine alert history with source logs to locate trigger causes, analyze alert frequency and duration.

Scenario 1: Create Log Alert

In cn-hangzhou prod-web create web-500-alert, data source nginx-access. Check past 5 minutes logs every 1 minute, alert when status=500 request count >= 100, email to existing contact [email protected].

Scenario 2: Analyze Historical Alerts

Analyze cn-hangzhou prod-web/web-500-alert alerts from 2026-10-08 09:00 to 10:00 Beijing time, verify trigger causes, frequency, duration, and combine with source logs to find error-concentrated interfaces, provide query evidence.

Note: "Every 1 minute" is check frequency, "past 5 minutes" is query window. Rule configuration, execution, and notification delivery need separate verification.

5. alibabacloud-sls-dashboard

Create and modify dashboards, charts, and filter controls; troubleshoot display issues; manage dashboard subscriptions. Supports configuring query results as monitoring panels showing request volume, error rate, latency, etc.

Scenario 1: Create Request Monitoring Dashboard

Create request monitoring dashboard for cn-hangzhou prod-web/nginx-access. Show per-minute request count, 5xx count, average request_time (seconds), add service filter control, verify query first, then publish to prod-web.

Scenario 2: Adjust Existing Dashboard

Read web-overview dashboard in cn-hangzhou prod-web, add error count Top 10 chart by request_uri, retain other charts and filter controls, verify configuration after update.

6. alibabacloud-sls-data-agent

Invoke SLS Data Agent, using digital employees to complete data extraction, processing, analysis, and visualization; assist anomaly troubleshooting and root cause analysis; support retaining analysis sessions, multi-round follow-up, and log drill-down. This skill depends on StarOps digital employee capability; requires available StarOps digital employee and target Project.

Scenario: Analyze Anomaly and Continue Drill-down

Use SLS Data Agent and digital employee apsara-ops to analyze cn-hangzhou prod-web/nginx-access request volume, error rate, and latency in the last hour, identify anomalous periods, provide charts and analysis conclusions.

Can continue in same session:

Continue analyzing the anomalous period just now, compare error rates by interface, find the interface with largest change.

7. alibabacloud-sls-index-config-management

Manage Logstore indexes; generate configurations from log samples; adjust field types and statistical configurations based on query needs. Supports index view, create, modify, delete, and write throughput/storage cost optimization.

Scenario 1: Generate Index from Log Sample

Generate index configuration for the following log sample, need to filter by status, group by service, and calculate average latency_ms. Provide configuration JSON and field descriptions first, do not execute update. {"status":500,"service":"order","latency_ms":238.5,"message":"timeout"}

Scenario 2: Add Analysis Fields

Read index of cn-hangzhou prod-web/app-logs, configure double type for latency_ms and enable statistics for average analysis; retain other field configurations, provide change details.

8. alibabacloud-sls-sdk-guidance

Automatically select SLS SDK based on programming language and business scenario; provide dependency installation, initialization, and code examples. Supports log writing, consumption, query, and Log4j2/Logback framework integration.

Scenario 1: Select Write and Consume SDK

Select SLS SDK for Java 17 project. Logs need async batch write; consumer needs Consumer Group, checkpoint, and multi-instance load balancing. Provide selection rationale, Maven dependencies, and minimal integration example.

Scenario 2: Integrate via Log4j2

Java project has Log4j2, want to send logs to cn-hangzhou prod-web/app-logs via Appender. Provide Maven dependencies and log4j2.xml configuration.

Configure Credentials

SLS skills primarily rely on Aliyun CLI and SLS plugin. Besides static AccessKey, OAuth, EcsRamRole, and other credential types that don't require long-term AccessKey configuration are supported. All credential types and configuration methods are documented in Alibaba Cloud CLI: Configure and Manage Identity Credentials (https://help.aliyun.com/zh/cli/configure-credentials). After authentication, corresponding RAM permissions for resources are still required.

Aliyun CLI supports storing credential and region information in profiles for quick switching between identities, regions, and credential types. Default profile name is default. List existing profiles with:

aliyun configure list

Static AccessKey

Configure profile with static AccessKey:

aliyun configure # configure default profile
aliyun configure --profile <profileName> # configure named profile, auto-creates if not exists

OAuth Login Authorization

For environments with browser access (e.g., local Mac on corporate network), OAuth is simpler. First login requires account authorization. Then configure specified profile with OAuth, which automatically opens browser for login authorization:

aliyun configure --mode OAuth --profile <profileName>

Manage Cross-Region Project Resources

alibabacloud-sls-query includes cross-region Project discovery. When default region cannot find Project or user is unsure of Project region, agent globally searches for the Project, obtains its Region and Endpoint, and uses discovered Endpoint for subsequent queries, eliminating manual region/endpoint lookup and setting.

Manual query also possible (requires fixed endpoint cn-zhangjiakou.log.aliyuncs.com):

aliyun sls get-project --project <projectName> --cross-region true --endpoint cn-zhangjiakou.log.aliyuncs.com

FAQ

Need to pre-install CLI and SLS plugin?

Required for cloud operations. Agent checks CLI and SLS plugin, provides installation/upgrade guidance if missing or version insufficient. No cloud resource access needed for config interpretation or code example generation.

Can internal network, transfer acceleration, or custom Endpoint be used?

Yes. Specify Endpoint in requirement, e.g., cn-hangzhou-intranet.log.aliyuncs.com, and ensure runtime environment can access it.

Which skills are recommended for installation?

alibabacloud-sls-query is the most recommended skill; install directly for significant help with log query analysis and SQL/SPL generation. Other skills can be installed based on actual needs.

How to access Normandy-managed log resources?

Currently aliyun cli does not support Normandy authentication. Recommend installing and using normandy-cli skill (https://github.com/open-telemetry/opentelemetry-go-compile-instrumentation), combined with alibabacloud-sls-query skill.

Summary

Through official CLI and 8 Agent Skills, SLS has connected log collection, SDK integration, resource and index management, query analysis, alerting, visualization, and root cause analysis capabilities, covering the complete log lifecycle. Combined with multiple authentication methods and cross-region resource discovery, users can organize tasks around business goals, reducing environment configuration, command writing, and tool switching overhead.

Currently, CLI daily requests exceed 1.1 million, Skills daily requests exceed 500,000. CLI daily requests are ~700x February 2026 levels. CLI and Skills are becoming the daily entry point for developers and operators using SLS.

Future plans: further improve skill scenario coverage, enhance multi-skill collaboration and complex problem analysis, incorporate more verified operational procedures and troubleshooting experience into skills. While improving execution accuracy and reliability, continue building SLS as an AI-first, Agent-native observability platform, enabling data, tools, and product capabilities to be naturally invoked and combined by agents, fully unleashing agent potential in data analysis, system diagnosis, and automated operations.