小编Hir*_*ess的帖子

我四处搜索，找不到关于这个主题的太多东西（可能是不好的搜索词：）。我有一个表 Protopayload.resource，它获取 Apache 日志信息。因此，我感兴趣的字段包含我需要搜索的多个值。该字段的格式为 php URL 样式。IE

/?id=13242134123&ver=12&os_bits=64&os_type=mac&lng=EN

这使得所有搜索最终都以非常长的正则表达式来获取数据。然后join语句来合并数据。

结合 mac/win 统计信息的示例搜索

SELECT
  t1.date, t1.wincount, COALESCE(t2.maccount, 0) AS maccount
FROM (
  SELECT
    DATE(metadata.timestamp) AS date,
    INTEGER(COUNT(protoPayload.resource)) AS wincount
  FROM (TABLE_DATE_RANGE(tablename, DATE_ADD(CURRENT_TIMESTAMP(), -30, 'DAY'), CURRENT_TIMESTAMP() ))
  WHERE
    (REGEXP_MATCH(protoPayload.resource, r'ver=[11,12'))
    AND protoPayload.resource CONTAINS 'os=win' GROUP BY date ) t1
LEFT JOIN (
  SELECT
    DATE(metadata.timestamp) AS date,
    INTEGER(COUNT(protoPayload.resource)) AS maccount
  FROM (TABLE_DATE_RANGE(tablename, DATE_ADD(CURRENT_TIMESTAMP(), -30, 'DAY'), CURRENT_TIMESTAMP() ))
  WHERE
    (REGEXP_MATCH(protoPayload.resource, r'cv=[p,m][17,16,15,14]'))
    AND protoPayload.resource CONTAINS 'os=mac' GROUP BY date ) t2
ON
  t1.date = t2.date …