{"expand":"renderedFields,names,schema,operations,editmeta,changelog,versionedRepresentations","id":"33656","self":"https://jira.geedge.net/rest/api/2/issue/33656","key":"OMPUB-873","fields":{"issuetype":{"self":"https://jira.geedge.net/rest/api/2/issuetype/10002","id":"10002","description":"需要完成的任务。","iconUrl":"https://jira.geedge.net/secure/viewavatar?size=xsmall&avatarId=10318&avatarType=issuetype","name":"任务","subtask":false,"avatarId":10318},"components":[],"timespent":null,"timeoriginalestimate":null,"description":"针对Dos Events数据，能否快速统计出指定时间段内，某一个destination ip 的top N source ip 信息嘛。\r\n\r\n目前在E现场统计2022-09-01~2023-03-16时间段内，Dos Events里Severity=Critical的日志信息，\r\n\r\nTop 2 Destination IP分别为：\r\n\r\n197.156.74.223：236次\r\n\r\n197.156.74.222：166次\r\n\r\n \r\n\r\n搜索指定destination IP的日志，得到的是Source IPs列表，里面甚至有很多是Private IP,如何能快速统计出指定时间段具体某个destination ip 的top N source ip 及出现的总次数。","project":{"self":"https://jira.geedge.net/rest/api/2/project/10206","id":"10206","key":"OMPUB","name":"Operation and Maintenance","projectTypeKey":"business","avatarUrls":{"48x48":"https://jira.geedge.net/secure/projectavatar?pid=10206&avatarId=10715","24x24":"https://jira.geedge.net/secure/projectavatar?size=small&pid=10206&avatarId=10715","16x16":"https://jira.geedge.net/secure/projectavatar?size=xsmall&pid=10206&avatarId=10715","32x32":"https://jira.geedge.net/secure/projectavatar?size=medium&pid=10206&avatarId=10715"},"projectCategory":{"self":"https://jira.geedge.net/rest/api/2/projectCategory/10002","id":"10002","description":"系统运维","name":"MaintenanceDev"}},"fixVersions":[],"aggregatetimespent":null,"resolution":{"self":"https://jira.geedge.net/rest/api/2/resolution/10000","id":"10000","description":"该问题的工作流程已完成。","name":"完成"},"timetracking":{},"customfield_10401":null,"customfield_10104":null,"customfield_10402":null,"customfield_10105":"0|i03v50:","customfield_10403":null,"customfield_10404":null,"attachment":[{"self":"https://jira.geedge.net/rest/api/2/attachment/36666","id":"36666","filename":"Critical Dos Events.docx","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-03-28T02:27:14.586+0800","size":1386093,"mimeType":"application/vnd.openxmlformats-officedocument.wordprocessingml.document","content":"https://jira.geedge.net/secure/attachment/36666/Critical+Dos+Events.docx"},{"self":"https://jira.geedge.net/rest/api/2/attachment/37679","id":"37679","filename":"image-2023-05-04-11-00-42-114.png","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-05-04T16:01:10.468+0800","size":298749,"mimeType":"image/png","content":"https://jira.geedge.net/secure/attachment/37679/image-2023-05-04-11-00-42-114.png","thumbnail":"https://jira.geedge.net/secure/thumbnail/37679/_thumb_37679.png"},{"self":"https://jira.geedge.net/rest/api/2/attachment/37923","id":"37923","filename":"screenshot-1.png","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuyang","name":"liuyang","key":"JIRAUSER10102","emailAddress":"liuyang@geedgenetworks.com","avatarUrls":{"48x48":"https://jira.geedge.net/secure/useravatar?avatarId=10341","24x24":"https://jira.geedge.net/secure/useravatar?size=small&avatarId=10341","16x16":"https://jira.geedge.net/secure/useravatar?size=xsmall&avatarId=10341","32x32":"https://jira.geedge.net/secure/useravatar?size=medium&avatarId=10341"},"displayName":"刘洋","active":true,"timeZone":"Asia/Shanghai"},"created":"2023-05-12T20:58:16.718+0800","size":49949,"mimeType":"image/png","content":"https://jira.geedge.net/secure/attachment/37923/screenshot-1.png","thumbnail":"https://jira.geedge.net/secure/thumbnail/37923/_thumb_37923.png"},{"self":"https://jira.geedge.net/rest/api/2/attachment/36665","id":"36665","filename":"微信图片_20230327212759.png","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-03-28T02:28:17.482+0800","size":286281,"mimeType":"image/png","content":"https://jira.geedge.net/secure/attachment/36665/%E5%BE%AE%E4%BF%A1%E5%9B%BE%E7%89%87_20230327212759.png","thumbnail":"https://jira.geedge.net/secure/thumbnail/36665/_thumb_36665.png"},{"self":"https://jira.geedge.net/rest/api/2/attachment/37681","id":"37681","filename":"微信图片_20230504171242.png","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-05-04T22:13:38.687+0800","size":55677,"mimeType":"image/png","content":"https://jira.geedge.net/secure/attachment/37681/%E5%BE%AE%E4%BF%A1%E5%9B%BE%E7%89%87_20230504171242.png","thumbnail":"https://jira.geedge.net/secure/thumbnail/37681/_thumb_37681.png"},{"self":"https://jira.geedge.net/rest/api/2/attachment/37682","id":"37682","filename":"微信图片_20230504171250.png","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-05-04T22:13:41.223+0800","size":64940,"mimeType":"image/png","content":"https://jira.geedge.net/secure/attachment/37682/%E5%BE%AE%E4%BF%A1%E5%9B%BE%E7%89%87_20230504171250.png","thumbnail":"https://jira.geedge.net/secure/thumbnail/37682/_thumb_37682.png"},{"self":"https://jira.geedge.net/rest/api/2/attachment/37683","id":"37683","filename":"微信图片_20230504171552.png","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-05-04T22:16:23.912+0800","size":58656,"mimeType":"image/png","content":"https://jira.geedge.net/secure/attachment/37683/%E5%BE%AE%E4%BF%A1%E5%9B%BE%E7%89%87_20230504171552.png","thumbnail":"https://jira.geedge.net/secure/thumbnail/37683/_thumb_37683.png"},{"self":"https://jira.geedge.net/rest/api/2/attachment/37684","id":"37684","filename":"微信图片_20230504171559.png","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-05-04T22:16:31.538+0800","size":67878,"mimeType":"image/png","content":"https://jira.geedge.net/secure/attachment/37684/%E5%BE%AE%E4%BF%A1%E5%9B%BE%E7%89%87_20230504171559.png","thumbnail":"https://jira.geedge.net/secure/thumbnail/37684/_thumb_37684.png"}],"aggregatetimeestimate":null,"resolutiondate":"2023-06-19T22:37:47.986+0800","workratio":-1,"summary":"【E21现场】针对Dos Events数据，能否快速统计出针对某一个destination ip 的top  N source ip ","lastViewed":null,"watches":{"self":"https://jira.geedge.net/rest/api/2/issue/OMPUB-873/watchers","watchCount":6,"isWatching":false},"creator":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"subtasks":[],"created":"2023-03-28T02:35:39.353+0800","reporter":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"customfield_10000":"{summaryBean=com.atlassian.jira.plugin.devstatus.rest.SummaryBean@4dc240ea[summary={pullrequest=com.atlassian.jira.plugin.devstatus.rest.SummaryItemBean@1fac56ec[overall=PullRequestOverallBean{stateCount=0, state='OPEN', details=PullRequestOverallDetails{openCount=0, mergedCount=0, declinedCount=0}},byInstanceType={}], build=com.atlassian.jira.plugin.devstatus.rest.SummaryItemBean@d03a888[overall=com.atlassian.jira.plugin.devstatus.summary.beans.BuildOverallBean@70e584f2[failedBuildCount=0,successfulBuildCount=0,unknownBuildCount=0,count=0,lastUpdated=<null>,lastUpdatedTimestamp=<null>],byInstanceType={}], review=com.atlassian.jira.plugin.devstatus.rest.SummaryItemBean@6d47fca5[overall=com.atlassian.jira.plugin.devstatus.summary.beans.ReviewsOverallBean@747e3ed3[stateCount=0,state=<null>,dueDate=<null>,overDue=false,count=0,lastUpdated=<null>,lastUpdatedTimestamp=<null>],byInstanceType={}], deployment-environment=com.atlassian.jira.plugin.devstatus.rest.SummaryItemBean@64299f3c[overall=com.atlassian.jira.plugin.devstatus.summary.beans.DeploymentOverallBean@3837455f[topEnvironments=[],showProjects=false,successfulCount=0,count=0,lastUpdated=<null>,lastUpdatedTimestamp=<null>],byInstanceType={}], repository=com.atlassian.jira.plugin.devstatus.rest.SummaryItemBean@6ac72428[overall=com.atlassian.jira.plugin.devstatus.summary.beans.CommitOverallBean@6fca1705[count=0,lastUpdated=<null>,lastUpdatedTimestamp=<null>],byInstanceType={}], branch=com.atlassian.jira.plugin.devstatus.rest.SummaryItemBean@4732b5bf[overall=com.atlassian.jira.plugin.devstatus.summary.beans.BranchOverallBean@452d1dbb[count=0,lastUpdated=<null>,lastUpdatedTimestamp=<null>],byInstanceType={}]},errors=[],configErrors=[]], devSummaryJson={\"cachedValue\":{\"errors\":[],\"configErrors\":[],\"summary\":{\"pullrequest\":{\"overall\":{\"count\":0,\"lastUpdated\":null,\"stateCount\":0,\"state\":\"OPEN\",\"details\":{\"openCount\":0,\"mergedCount\":0,\"declinedCount\":0,\"total\":0},\"open\":true},\"byInstanceType\":{}},\"build\":{\"overall\":{\"count\":0,\"lastUpdated\":null,\"failedBuildCount\":0,\"successfulBuildCount\":0,\"unknownBuildCount\":0},\"byInstanceType\":{}},\"review\":{\"overall\":{\"count\":0,\"lastUpdated\":null,\"stateCount\":0,\"state\":null,\"dueDate\":null,\"overDue\":false,\"completed\":false},\"byInstanceType\":{}},\"deployment-environment\":{\"overall\":{\"count\":0,\"lastUpdated\":null,\"topEnvironments\":[],\"showProjects\":false,\"successfulCount\":0},\"byInstanceType\":{}},\"repository\":{\"overall\":{\"count\":0,\"lastUpdated\":null},\"byInstanceType\":{}},\"branch\":{\"overall\":{\"count\":0,\"lastUpdated\":null},\"byInstanceType\":{}}}},\"isStale\":false}}","aggregateprogress":{"progress":0,"total":0},"customfield_10100":null,"priority":{"self":"https://jira.geedge.net/rest/api/2/priority/3","iconUrl":"https://jira.geedge.net/images/icons/priorities/medium.svg","name":"Medium","id":"3"},"customfield_10200":null,"customfield_10400":null,"labels":["E21现场"],"environment":null,"timeestimate":null,"aggregatetimeoriginalestimate":null,"versions":[],"duedate":null,"progress":{"progress":0,"total":0},"issuelinks":[],"comment":{"comments":[{"self":"https://jira.geedge.net/rest/api/2/issue/33656/comment/56487","id":"56487","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=doufenghu","name":"doufenghu","key":"JIRAUSER10107","emailAddress":"doufenghu@geedgenetworks.com","avatarUrls":{"48x48":"https://jira.geedge.net/secure/useravatar?ownerId=JIRAUSER10107&avatarId=11700","24x24":"https://jira.geedge.net/secure/useravatar?size=small&ownerId=JIRAUSER10107&avatarId=11700","16x16":"https://jira.geedge.net/secure/useravatar?size=xsmall&ownerId=JIRAUSER10107&avatarId=11700","32x32":"https://jira.geedge.net/secure/useravatar?size=medium&ownerId=JIRAUSER10107&avatarId=11700"},"displayName":"窦凤虎","active":true,"timeZone":"Asia/Shanghai"},"body":"* 通过SQL查询获取结果\r\n\r\n{code:java}\r\nselect item, sum(count) as count from ( select arrayJoin(items) as item,count from ( select splitByString(',', source_ip_list) as items, count(*) as count from dos_event lt where destination_ip = '27.50.64.2' and notEmpty(source_ip_list) and start_time >= toUnixTimestamp(parseDateTimeBestEffort(toString('2023-03-10 00:00:00+03:00'))) AND start_time < toUnixTimestamp(parseDateTimeBestEffort(toString('2023-03-26 00:00:00+03:00'))) group by source_ip_list ) ) group by item order by count desc limit 10\r\n {code}\r\n * 后续版本支持：\r\n ** 方式1: 可在23.04  Source IPs 定义业务逻辑类型为Array，作为多值列统计（基于v23.03业务逻辑类型定义支持）\r\n ** 方式2: Report Log Type增加 DoS Events ，增加预置数据集","updateAuthor":{"self":"https://jira.geedge.net/rest/api/2/user?username=doufenghu","name":"doufenghu","key":"JIRAUSER10107","emailAddress":"doufenghu@geedgenetworks.com","avatarUrls":{"48x48":"https://jira.geedge.net/secure/useravatar?ownerId=JIRAUSER10107&avatarId=11700","24x24":"https://jira.geedge.net/secure/useravatar?size=small&ownerId=JIRAUSER10107&avatarId=11700","16x16":"https://jira.geedge.net/secure/useravatar?size=xsmall&ownerId=JIRAUSER10107&avatarId=11700","32x32":"https://jira.geedge.net/secure/useravatar?size=medium&ownerId=JIRAUSER10107&avatarId=11700"},"displayName":"窦凤虎","active":true,"timeZone":"Asia/Shanghai"},"created":"2023-03-30T14:58:25.140+0800","updated":"2023-03-30T15:04:13.501+0800"},{"self":"https://jira.geedge.net/rest/api/2/issue/33656/comment/56536","id":"56536","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"body":"收到","updateAuthor":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-03-31T22:27:47.207+0800","updated":"2023-03-31T22:27:47.207+0800"},{"self":"https://jira.geedge.net/rest/api/2/issue/33656/comment/56622","id":"56622","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuyang","name":"liuyang","key":"JIRAUSER10102","emailAddress":"liuyang@geedgenetworks.com","avatarUrls":{"48x48":"https://jira.geedge.net/secure/useravatar?avatarId=10341","24x24":"https://jira.geedge.net/secure/useravatar?size=small&avatarId=10341","16x16":"https://jira.geedge.net/secure/useravatar?size=xsmall&avatarId=10341","32x32":"https://jira.geedge.net/secure/useravatar?size=medium&avatarId=10341"},"displayName":"刘洋","active":true,"timeZone":"Asia/Shanghai"},"body":"通过session record搜索server ip为目标IP，然后通过日志字段发现查看top 10的client ip是否能够满足需求？[~liuju]","updateAuthor":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuyang","name":"liuyang","key":"JIRAUSER10102","emailAddress":"liuyang@geedgenetworks.com","avatarUrls":{"48x48":"https://jira.geedge.net/secure/useravatar?avatarId=10341","24x24":"https://jira.geedge.net/secure/useravatar?size=small&avatarId=10341","16x16":"https://jira.geedge.net/secure/useravatar?size=xsmall&avatarId=10341","32x32":"https://jira.geedge.net/secure/useravatar?size=medium&avatarId=10341"},"displayName":"刘洋","active":true,"timeZone":"Asia/Shanghai"},"created":"2023-04-04T09:22:01.118+0800","updated":"2023-04-04T09:22:01.118+0800"},{"self":"https://jira.geedge.net/rest/api/2/issue/33656/comment/57865","id":"57865","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"body":"[~liuyang] 洋姐，你意思是像附件那种截图里的那样搜索嘛，搜索结果现场top 10 的结果是10个集合（source ips）和预期不符，想要的是top N client ip。","updateAuthor":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-05-04T16:01:28.997+0800","updated":"2023-05-04T16:01:28.997+0800"},{"self":"https://jira.geedge.net/rest/api/2/issue/33656/comment/57871","id":"57871","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"body":"根据虎哥提供的查询语句，查询4月份Destination IP为197.156.74.223/222出的top 10  client ip 全是10.x.x.x私网ip,后根据岱杰更新的语句，可以查询4月份Destination IP为197.156.74.223/222排除了私网IP之后的top 10  client ip和count ，目前查询的结果已上传展示在了附件中。\r\n\r\n执行的更新后查询语句如下：\r\n\r\n1、\r\nclickhouse-client -h 10.224.11.35 --port 9001 -m -u default -d tsg_galaxy_v3 --password ***\r\n\r\n2、\r\n\r\nselect item, sum(count) as count from ( select arrayJoin(items) as item,count from ( select splitByString(',', source_ip_list) as items, count(*)as count from dos_event lt where destination_ip = '27.50.64.2' and notEmpty(source_ip_list) and start_time >= toUnixTimestamp(parseDateTimeBestEffort(toString('2023-03-10 00:00:00+03:00'))) AND start_time < toUnixTimestamp(parseDateTimeBestEffort(toString('2023-03-26 00:00:00+03:00'))) group by source_ip_list ) ) where (item not like('10.%') AND item not like('172.%') AND item not like('192.168.%')) group by item order by count desc limit 10;","updateAuthor":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuju","name":"liuju","key":"JIRAUSER10222","emailAddress":"liuju@zdjizhi.com","avatarUrls":{"48x48":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=48","24x24":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=24","16x16":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=16","32x32":"https://www.gravatar.com/avatar/de39e01c583621fe2030d723f55e0e79?d=mm&s=32"},"displayName":"刘菊","active":false,"timeZone":"Asia/Shanghai"},"created":"2023-05-04T22:21:10.663+0800","updated":"2023-05-05T14:46:23.281+0800"},{"self":"https://jira.geedge.net/rest/api/2/issue/33656/comment/58194","id":"58194","author":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuyang","name":"liuyang","key":"JIRAUSER10102","emailAddress":"liuyang@geedgenetworks.com","avatarUrls":{"48x48":"https://jira.geedge.net/secure/useravatar?avatarId=10341","24x24":"https://jira.geedge.net/secure/useravatar?size=small&avatarId=10341","16x16":"https://jira.geedge.net/secure/useravatar?size=xsmall&avatarId=10341","32x32":"https://jira.geedge.net/secure/useravatar?size=medium&avatarId=10341"},"displayName":"刘洋","active":true,"timeZone":"Asia/Shanghai"},"body":"[~liuju]直接在 session record中搜索，不是dos event中搜索\r\n !screenshot-1.png|thumbnail! ","updateAuthor":{"self":"https://jira.geedge.net/rest/api/2/user?username=liuyang","name":"liuyang","key":"JIRAUSER10102","emailAddress":"liuyang@geedgenetworks.com","avatarUrls":{"48x48":"https://jira.geedge.net/secure/useravatar?avatarId=10341","24x24":"https://jira.geedge.net/secure/useravatar?size=small&avatarId=10341","16x16":"https://jira.geedge.net/secure/useravatar?size=xsmall&avatarId=10341","32x32":"https://jira.geedge.net/secure/useravatar?size=medium&avatarId=10341"},"displayName":"刘洋","active":true,"timeZone":"Asia/Shanghai"},"created":"2023-05-12T20:58:19.110+0800","updated":"2023-05-12T20:58:19.110+0800"}],"maxResults":6,"total":6,"startAt":0},"votes":{"self":"https://jira.geedge.net/rest/api/2/issue/OMPUB-873/votes","votes":0,"hasVoted":false},"worklog":{"startAt":0,"maxResults":20,"total":0,"worklogs":[]},"assignee":null,"updated":"2024-01-12T18:11:53.651+0800","status":{"self":"https://jira.geedge.net/rest/api/2/status/10102","description":"","iconUrl":"https://jira.geedge.net/images/icons/status_generic.gif","name":"完成","id":"10102","statusCategory":{"self":"https://jira.geedge.net/rest/api/2/statuscategory/3","id":3,"key":"done","colorName":"green","name":"完成"}}}}