You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: stream-processing/getting-started/fluent-bit-sql.md
+19-19
Original file line number
Diff line number
Diff line change
@@ -2,13 +2,13 @@
2
2
3
3
Stream processing in Fluent Bit uses SQL to perform record queries.
4
4
5
-
For additional information, see the [stream processing README file](https://github.com/fluent/fluent-bit/tree/master/src/stream_processor).
5
+
For more information, see the [stream processing README file](https://github.com/fluent/fluent-bit/tree/master/src/stream_processor).
6
6
7
7
## Statements
8
8
9
9
Use the following SQL statements in Fluent Bit.
10
10
11
-
### SELECT
11
+
### `SELECT`
12
12
13
13
```sql
14
14
SELECT results_statement
@@ -24,7 +24,7 @@ Groups keys from records that originate from a specified stream, or from records
24
24
A `SELECT` statement not associated with stream creation will send the results to the standard output interface, which can be helpful for debugging purposes.
25
25
{% endhint %}
26
26
27
-
You can filter the results of this query by applying a condition through a `WHERE` statement. For information about the `WINDOW` and `GROUP BY` statements, see [Aggregation functions](#aggregation-functions).
27
+
You can filter the results of this query by applying a condition by using a `WHERE` statement. For information about the `WINDOW` and `GROUP BY` statements, see [Aggregation functions](#aggregation-functions).
28
28
29
29
#### Examples
30
30
@@ -40,7 +40,7 @@ Selects the `code` key from records with tags whose name begins with `apache`:
40
40
SELECT code AS http_status FROM TAG:'apache.*';
41
41
```
42
42
43
-
### CREATE STREAM
43
+
### `CREATE STREAM`
44
44
45
45
```sql
46
46
CREATE STREAM stream_name
@@ -64,46 +64,46 @@ Creates a new stream called `hello` for all records whose original tag name begi
64
64
CREATE STREAM hello ASSELECT*FROM TAG:'apache.*';
65
65
```
66
66
67
-
## Aggregation Functions
67
+
## Aggregation functions
68
68
69
69
You can use aggregation functions in the `results_statement` on keys, which lets you perform data calculation on groups of records. These groups are determined by the `WINDOW` key. If `WINDOW` is unspecified, aggregation functions are applied to the current buffer of records received, which might have a non-deterministic number of elements. You can also apply aggregation functions to records in a window of a specific time interval.
70
70
71
71
Fluent Bit uses a tumbling window, which is non-overlapping. For example, a window size of `5` performs aggregation computations on records during a five-second interval, then starts new calculations for the next interval.
72
72
73
73
Additionally, you can use the `GROUP BY` statement to group results by one or more keys with matching values.
74
74
75
-
### AVG
75
+
### `AVG`
76
76
77
77
```sql
78
78
SELECTAVG(size) FROM STREAM:apache WHERE method ='POST' ;
79
79
```
80
80
81
-
Calculates the average size of POST requests.
81
+
Calculates the average size of `POST` requests.
82
82
83
-
### COUNT
83
+
### `COUNT`
84
84
85
85
```sql
86
86
SELECT host, COUNT(*) FROM STREAM:apache WINDOW TUMBLING (X SECOND) GROUP BY host;
87
87
```
88
88
89
-
Counts the number of records in 5 second window, grouped by host IP addresses.
89
+
Counts the number of records in a five-second window, grouped by host IP addresses.
90
90
91
-
### MIN
91
+
### `MIN`
92
92
93
93
```sql
94
94
SELECTMIN(key) FROM STREAM:apache;
95
95
```
96
96
97
97
Returns the minimum value of a key in a set of records.
98
98
99
-
### MAX
99
+
### `MAX`
100
100
101
101
```sql
102
102
SELECTMAX(key) FROM STREAM:apache;
103
103
```
104
104
Returns the maximum value of a key in a set of records.
105
105
106
-
### SUM
106
+
### `SUM`
107
107
108
108
```sql
109
109
SELECTSUM(key) FROM STREAM:apache;
@@ -115,15 +115,15 @@ Calculates the sum of all values of a key in a set of records.
115
115
116
116
Use time functions to add a new key with time data into a record.
117
117
118
-
### NOW
118
+
### `NOW`
119
119
120
120
```sql
121
121
SELECT NOW() FROM STREAM:apache;
122
122
```
123
123
124
124
Adds the current system time to a record using the format `%Y-%m-%d %H:%M:%S`. Output example: `2019-03-09 21:36:05`.
125
125
126
-
### UNIX\_TIMESTAMP
126
+
### `UNIX_TIMESTAMP`
127
127
128
128
```sql
129
129
SELECT UNIX_TIMESTAMP() FROM STREAM:apache;
@@ -135,21 +135,21 @@ Adds the current Unix time to a record. Output example: `1552196165`.
135
135
136
136
Use record functions to append new keys to a record using values from the record's context.
137
137
138
-
### RECORD\_TAG
138
+
### `RECORD_TAG`
139
139
140
140
```sql
141
141
SELECT RECORD_TAG() FROM STREAM:apache;
142
142
```
143
143
144
-
Append Tag string associated to the record as a new key.
144
+
Append tag string associated to the record as a new key.
145
145
146
-
### RECORD\_TIME
146
+
### `RECORD_TIME`
147
147
148
148
```sql
149
149
SELECT RECORD_TIME() FROM STREAM:apache;
150
150
```
151
151
152
-
## The WHERE condition
152
+
## `WHERE` condition
153
153
154
154
Similar to conventional SQL statements, Fluent Bit supports the `WHERE` condition. You can use this condition in both keys and subkeys. For example:
155
155
@@ -163,7 +163,7 @@ You can confirm whether a key exists in a record by using the record-specific fu
163
163
SELECTMAX(key) FROM STREAM:apache WHERE @record.contains(key);
164
164
```
165
165
166
-
And to check whether the value of a key is `NULL`:
166
+
To determine if the value of a key is `NULL`:
167
167
168
168
```sql
169
169
SELECTMAX(key) FROM STREAM:apache WHERE key IS NULL;
0 commit comments