|
| 1 | +-- Schema |
| 2 | +CREATE TABLE logs |
| 3 | +( |
| 4 | + `remote_addr` String, |
| 5 | + `remote_user` String, |
| 6 | + `runtime` UInt64, |
| 7 | + `time_local` DateTime, |
| 8 | + `request_type` String, |
| 9 | + `request_path` String, |
| 10 | + `request_protocol` String, |
| 11 | + `status` UInt64, |
| 12 | + `size` UInt64, |
| 13 | + `referer` String, |
| 14 | + `user_agent` String |
| 15 | +) |
| 16 | +ENGINE = MergeTree |
| 17 | +ORDER BY (toStartOfHour(time_local), status, request_path, remote_addr); |
| 18 | + |
| 19 | +-- Simple Select Queries |
| 20 | +SELECT * FROM logs; |
| 21 | + |
| 22 | +SELECT toStartOfInterval(toDateTime(time_local), INTERVAL 900 second) AS time, count() |
| 23 | +FROM logs |
| 24 | +WHERE time_local >= '1548288000' AND time_local <= '1550966400' |
| 25 | +AND status = 404 AND request_path = '/apple-touch-icon-precomposed.png' |
| 26 | +AND remote_addr = '2.185.223.153' AND runtime > 4000 |
| 27 | +GROUP BY time |
| 28 | +ORDER BY time ASC |
| 29 | +LIMIT 10000; |
| 30 | + |
| 31 | +-- Join Query |
| 32 | +SELECT toStartOfInterval(toDateTime(l.time_local), INTERVAL 900 second) AS time, count() |
| 33 | +FROM logs l |
| 34 | +JOIN logs_local ll ON l.remote_addr = ll.remote_addr AND l.time_local = ll.time_local |
| 35 | +WHERE l.time_local >= '1548288000' |
| 36 | + AND l.time_local <= '1550966400' |
| 37 | + AND l.status = 404 |
| 38 | + AND l.request_path = '/apple-touch-icon-precomposed.png' |
| 39 | + AND l.remote_addr = '2.185.223.153' |
| 40 | + AND l.runtime > 4000 |
| 41 | +GROUP BY time |
| 42 | +ORDER BY time ASC |
| 43 | +LIMIT 10000; |
| 44 | + |
| 45 | +-- Aggregation Queries |
| 46 | +SELECT uniq(remote_addr) AS `unique ips` |
| 47 | +FROM logs |
| 48 | +WHERE time_local >= '1548288000' |
| 49 | +AND time_local <= '1550966400' |
| 50 | +AND status = 404 |
| 51 | +AND request_path = '/apple-touch-icon-precomposed.png' |
| 52 | +AND remote_addr = '2.185.223.153' |
| 53 | +AND runtime > 4000; |
| 54 | + |
| 55 | +SELECT toStartOfInterval(toDateTime(time_local), INTERVAL 900 second) AS time, avg(runtime) AS avg_request_time, quantile(0.99)(runtime) AS 99_runtime |
| 56 | +FROM logs |
| 57 | +WHERE time_local >= '1548288000' |
| 58 | +AND time_local <= '1550966400' |
| 59 | +AND status = 404 |
| 60 | +AND request_path = '/apple-touch-icon-precomposed.png' |
| 61 | +AND remote_addr = '2.185.223.153' |
| 62 | +AND runtime > 4000 |
| 63 | +GROUP BY time |
| 64 | +ORDER BY time ASC |
| 65 | +LIMIT 100000; |
0 commit comments