监控 Cortex Search 请求

Cortex Search 会记录有关搜索请求的详细信息，用于监控和调试目的。启用请求日志记录后，您可以查看 Cortex Search 服务的查询模式、响应时间和请求详情。

请求日志中收集的信息

Cortex Search 请求日志包含以下信息：

  • 操作类型（例如，QUERY）
  • 完整的请求正文，包括查询文本和参数
  • 响应状态代码
  • 响应时间（以毫秒为单位）
  • 数据库、架构和服务名称
  • 用户、角色和会话信息

启用请求日志记录

To collect request logs for a Cortex Search Service, enable the REQUEST_LOGGING property on the service.

您可以在创建服务时启用请求日志记录：

CREATE CORTEX SEARCH SERVICE my_search_service
  ON text_col
  ATTRIBUTES category
  WAREHOUSE = my_wh
  TARGET_LAG = '1 hour'
  REQUEST_LOGGING = TRUE
AS (SELECT * FROM my_table);

您还可以在现有服务上启用请求日志记录：

ALTER CORTEX SEARCH SERVICE my_search_service SET REQUEST_LOGGING = TRUE;

要禁用请求日志记录，请执行以下步骤：

ALTER CORTEX SEARCH SERVICE my_search_service SET REQUEST_LOGGING = FALSE;

操作注意事项

日志数据量

Each logged Cortex Search request produces one event row in SNOWFLAKE.LOCAL.AI_OBSERVABILITY_EVENTS. How much data you accumulate depends on your request rate and how long logging stays enabled. Set retention and storage to match the log volume you expect to keep.

成本注意事项

Data stored in SNOWFLAKE.LOCAL tables incurs Snowflake storage charges. Querying request logs with SQL uses warehouse resources like any other query.

查询延迟

启用请求日志记录不会影响 Cortex Search 查询请求的延迟。

Cortex Search Service 的请求日志存储在事件表 SNOWFLAKE.LOCAL.AI_OBSERVABILITY_EVENTS 中。您可以通过表函数或直接查询事件表来访问这些日志。

Using the snowflake.local.get_ai_observability_events function

Users with the MONITOR privilege on a Cortex Search Service can view request logs for that service using the snowflake.local.get_ai_observability_events function.

  1. Grant MONITOR privilege: Grant the MONITOR privilege on the Cortex Search Service to the role that will use the function:

    USE ROLE ACCOUNTADMIN;
GRANT MONITOR ON CORTEX SEARCH SERVICE <service_name> TO ROLE <role_name>;

  2. Query observability events: Call snowflake.local.get_ai_observability_events using the role with the MONITOR privilege:

    USE ROLE <role_name>;
SELECT * FROM TABLE(snowflake.local.get_ai_observability_events(
  '<database_name>',
  '<schema_name>',
  '<service_name>',
  'CORTEX SEARCH SERVICE'
));

以 ACCOUNTADMIN 身份查询事件表

具有 ACCOUNTADMIN 角色的用户可以直接查询事件表：

USE ROLE ACCOUNTADMIN;
SELECT * FROM snowflake.local.ai_observability_events
WHERE observed_timestamp > TIMESTAMPADD(minute, -10, CURRENT_TIMESTAMP())
  AND record['name'] = 'CORTEX_SEARCH_REQUEST';

Note

Users with the ACCOUNTADMIN role can query the snowflake.local.ai_observability_events table and access the request events for all Cortex Search Services in the account.

访问控制与权限

要查看 Cortex Search 请求日志，用户必须具备以下条件之一：

  • 对 Cortex Search 服务的 OWNERSHIP 或 MONITOR 权限
  • ACCOUNTADMIN 角色（用于直接事件表访问）

The following example uses the ACCOUNTADMIN role to create a new role search_monitoring_role with the required permissions to view Cortex Search request logs:

USE ROLE ACCOUNTADMIN;
CREATE ROLE search_monitoring_role;
GRANT MONITOR ON CORTEX SEARCH SERVICE my_search_service TO ROLE search_monitoring_role;
GRANT ROLE search_monitoring_role TO USER some_user;

输出架构

The snowflake.local.get_ai_observability_events function returns a table with the following columns:

Columns

Column nameData typeDescription
TIMESTAMPTIMESTAMP_NTZ(9)Time of the event
START_TIMESTAMPTIMESTAMP_NTZ(9)Start time of the event (may be NULL)
TRACEOBJECTTrace information for the event (may be NULL)
RESOURCE_ATTRIBUTESOBJECTContains session, user, and role information including session ID, user ID, user name, role ID, and role name
RECORD_TYPESTRINGType of record, typically ‘EVENT’ for Cortex Search requests
RECORDOBJECTContains the event name, typically ‘CORTEX_SEARCH_REQUEST’
RECORD_ATTRIBUTESOBJECTContains detailed observability metadata including database, schema, service, user, role, and session information
VALUEVARIANTContains the actual request details including operation type, request body, response status code, and response time

VALUE 列包含以下关键字段：

  • snow.ai.observability.operation_type: The type of operation, such as ‘QUERY’
  • snow.ai.observability.request_body: The full request including query text and parameters
  • snow.ai.observability.response_status_code: HTTP status code of the response
  • snow.ai.observability.response_time_ms: Response time in milliseconds
  • snow.ai.observability.database.name: Database containing the Cortex Search Service
  • snow.ai.observability.schema.name: Schema containing the Cortex Search Service
  • snow.ai.observability.object.name: Name of the Cortex Search Service

以下是 VALUE 列中数据的示例：

{
  "snow.ai.observability.operation_type": "QUERY",
  "snow.ai.observability.request_body": {
    "experimental": null,
    "limit": 10,
    "multi_index_query": null,
    "query": "hello"
  },
  "snow.ai.observability.response_status_code": 200,
  "snow.ai.observability.response_time_ms": 391
}

示例

Query the request logs for the last 24 hours, using a role with MONITOR privilege on the service.

SELECT
  timestamp,
  record_attributes['ai.observability.record_id']::STRING as query_id,
  value['snow.ai.observability.request_body']['query']::STRING AS query_text,
  value['snow.ai.observability.request_body']['limit']::INT AS limit,
  value['snow.ai.observability.response_status_code']::INT AS status_code,
  value['snow.ai.observability.response_time_ms']::INT AS response_time_ms,
  record_attributes['snow.ai.observability.database.name']::STRING AS database_name,
  record_attributes['snow.ai.observability.schema.name']::STRING AS schema_name,
  record_attributes['snow.ai.observability.object.name']::STRING AS service_name,
  record_attributes['snow.ai.observability.user.name']::STRING AS user_name,
  record_attributes['snow.ai.observability.role.name']::STRING AS role_name,
  record_attributes['snow.ai.observability.session.id']::STRING AS session_id,
FROM TABLE(snowflake.local.get_ai_observability_events(
  '<database_name>',
  '<schema_name>',
  '<service_name>',
  'CORTEX SEARCH SERVICE'
))
WHERE timestamp > TIMESTAMPADD(hour, -24, CURRENT_TIMESTAMP())
ORDER BY timestamp DESC;