如何仅从 Amazon Athena 获取过去一周的记录

Question

我正在编写查询以获取过去一周的 Amazon Athena 记录。这是我到目前为止所写的：

WITH events AS (
  SELECT
    event.eventVersion,
    event.eventID,
    event.eventTime,
    event.eventName,
    event.eventType,
    event.eventSource,
    event.awsRegion,
    event.sourceIPAddress,
    event.userAgent,  
    event.userIdentity.type AS userType,
    event.userIdentity.arn AS userArn,
    event.userIdentity.principalId as userPrincipalId,
    event.userIdentity.accountId as userAccountId,
    event.userIdentity.userName as userName
  FROM cloudtrail.events
  CROSS JOIN UNNEST (Records) AS r (event)
)
SELECT userName,sourceIPAddress,eventName,eventTime FROM events WHERE eventName='ConsoleLogin';

但我不确定如何编写它以仅提取过去 1 周的记录。

Answer 1

@Phil?? 的回答差不多了。我只是在我的查询中使用它并找到了修复程序。我会发表评论，但没有足够的分数，所以这就是答案。

您必须使用current_timestamp然后将其转换为iso8601格式。像这样：

WITH events AS (
  SELECT
    event.eventVersion,
    event.eventID,
    event.eventTime,
    event.eventName,
    event.eventType,
    event.eventSource,
    event.awsRegion,
    event.sourceIPAddress,
    event.userAgent,  
    event.userIdentity.type AS userType,
    event.userIdentity.arn AS userArn,
    event.userIdentity.principalId as userPrincipalId,
    event.userIdentity.accountId as userAccountId,
    event.userIdentity.userName as userName
  FROM cloudtrail.events
  CROSS JOIN UNNEST (Records) AS r (event)
)
SELECT userName,sourceIPAddress,eventName,eventTime FROM events WHERE eventName='ConsoleLogin'
and eventTime > to_iso8601(current_timestamp - interval '7' day);

您可以通过执行如下测试查询来测试您实际需要的格式：

SELECT to_iso8601(current_date - interval '7' day);

返回：'2018-06-05'

SELECT to_iso8602(current_timestamp - interval '7' day);

返回：'2018-06-05T19:25:21.331Z'，与 event.eventTime 格式相同，并且有效。

Answer 2

Amazon Athena 使用Presto，因此您可以使用Presto 提供的任何日期函数。您会想要使用current_date - interval '7' day, 或类似的。

WITH events AS (
  SELECT
    event.eventVersion,
    event.eventID,
    event.eventTime,
    event.eventName,
    event.eventType,
    event.eventSource,
    event.awsRegion,
    event.sourceIPAddress,
    event.userAgent,  
    event.userIdentity.type AS userType,
    event.userIdentity.arn AS userArn,
    event.userIdentity.principalId as userPrincipalId,
    event.userIdentity.accountId as userAccountId,
    event.userIdentity.userName as userName
  FROM cloudtrail.events
  CROSS JOIN UNNEST (Records) AS r (event)
)
SELECT userName,sourceIPAddress,eventName,eventTime FROM events WHERE eventName='ConsoleLogin'
and eventTime > current_date - interval '7' day;

未经测试，我无法访问数据库进行测试。