create database IF NOT EXISTS tsg_galaxy_v3 ON CLUSTER ck_cluster;
create database IF NOT EXISTS tsg_galaxy_v3 ON CLUSTER ck_query;


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log_local ON CLUSTER ck_cluster(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	gtp_version String,
	gtp_apn String,
	gtp_imei String,
	gtp_imsi String,
	gtp_phone_number String,
	gtp_uplink_teid Int64,
	gtp_downlink_teid Int64,
	gtp_msg_type String,
	gtp_end_user_ipv4 String,
	gtp_end_user_ipv6 String
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (common_log_id,common_data_center,common_recv_time);



CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log ON CLUSTER ck_cluster(
		common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	gtp_version String,
	gtp_apn String,
	gtp_imei String,
	gtp_imsi String,
	gtp_phone_number String,
	gtp_uplink_teid Int64,
	gtp_downlink_teid Int64,
	gtp_msg_type String,
	gtp_end_user_ipv4 String,
	gtp_end_user_ipv6 String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,gtpc_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log ON CLUSTER ck_query(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	gtp_version String,
	gtp_apn String,
	gtp_imei String,
	gtp_imsi String,
	gtp_phone_number String,
	gtp_uplink_teid Int64,
	gtp_downlink_teid Int64,
	gtp_msg_type String,
	gtp_end_user_ipv4 String,
	gtp_end_user_ipv6 String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,gtpc_record_log_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log_local ON CLUSTER ck_cluster(
		common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (common_log_id,common_data_center,common_recv_time);


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log_local ON CLUSTER ck_cluster(
		common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (common_stream_trace_id,common_data_center,common_recv_time);



CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log ON CLUSTER ck_query(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,live_session_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log ON CLUSTER ck_cluster(
		common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,live_session_record_log_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log ON CLUSTER ck_query(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,transaction_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log ON CLUSTER ck_cluster(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,transaction_record_log_local,rand());




CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log_local ON CLUSTER ck_cluster(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
)ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_data_center,common_recv_time);

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log ON CLUSTER ck_query(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,voip_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log ON CLUSTER ck_cluster(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,voip_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log_local ON CLUSTER ck_cluster(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	nic_name String,
	origin_source_mac String,
	origin_dest_mac String,
	packet_url String,
	pcap_storage_task_id Int64,
	pcap_storage_duration Int64
)
ENGINE =MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log_local ON CLUSTER ck_cluster(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
	
)
ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log_local ON CLUSTER ck_cluster(
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	doh_url String,
	doh_host String,
	doh_request_line String,
	doh_response_line String,
	doh_cookie String,
	doh_referer String,
	doh_user_agent String,
	doh_content_length String,
	doh_content_type String,
	doh_set_cookie String,
	doh_version String,
	doh_message_id Int64,
	doh_qr Int64,
	doh_opcode Int64,
	doh_aa Int64,
	doh_tc Int64,
	doh_rd Int64,
	doh_ra Int64,
	doh_rcode Int64,
	doh_qdcount Int64,
	doh_ancount Int64,
	doh_nscount Int64,
	doh_arcount Int64,
	doh_qname String,
	doh_qtype Int64,
	doh_qclass Int64,
	doh_cname String,
	doh_sub Int64,
	doh_rr String
)
ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_local ON CLUSTER ck_cluster(
		common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (common_log_id,common_data_center,common_recv_time);

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log_local ON CLUSTER ck_cluster (
		common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	radius_packet_type Int64,
	radius_nas_ip String,
	radius_framed_ip String,
	radius_account String,
	radius_session_timeout Int64,
	radius_idle_timeout Int64,
	radius_acct_status_type Int64,
	radius_acct_terminate_cause Int64,
	radius_event_timestamp Int64,
	radius_nas_port Int64,
	radius_service_type Int64,
	radius_framed_protocol Int64,
	radius_callback_number String,
	radius_callback_id String,
	radius_termination_action Nullable(Int64),
	radius_called_station_id String,
	radius_calling_station_id String,
	radius_acct_delay_time Int64,
	radius_acct_session_id String,
	radius_acct_multi_session_id String,
	radius_acct_input_octets Int64,
	radius_acct_output_octets Int64,
	radius_acct_input_packets Int64,
	radius_acct_output_packets Int64,
	radius_acct_session_time Int64,
	radius_acct_link_count Int64,
	radius_acct_interim_interval Int64
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (common_log_id,common_data_center,common_recv_time);

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip_local ON CLUSTER ck_cluster(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (common_client_ip,common_server_ip,common_recv_time);


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip_local ON CLUSTER ck_cluster(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (common_server_ip,common_client_ip,common_recv_time);



CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id_local ON CLUSTER ck_cluster (
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (common_subscriber_id,common_recv_time);


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain_local ON CLUSTER ck_cluster(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
ORDER BY (http_domain,common_recv_time);


CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_client_ip  ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_common_client_ip_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;

CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_server_ip  ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_common_server_ip_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;

CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_subscriber_id  ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_common_subscriber_id_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;

CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_http_domain  ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_http_domain_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;




CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log_local ON CLUSTER ck_cluster(
	event_timestamp Int64,
	account String,
	framed_ip String,
	acct_status_type Int64,
	acct_session_id String,
	acct_session_time Int64
)
ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(event_timestamp))
ORDER BY (account,event_timestamp);

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log ON CLUSTER ck_query (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	radius_packet_type Int64,
	radius_nas_ip String,
	radius_framed_ip String,
	radius_account String,
	radius_session_timeout Int64,
	radius_idle_timeout Int64,
	radius_acct_status_type Int64,
	radius_acct_terminate_cause Int64,
	radius_event_timestamp Int64,
	radius_nas_port Int64,
	radius_service_type Int64,
	radius_framed_protocol Int64,
	radius_callback_number String,
	radius_callback_id String,
	radius_termination_action Nullable(Int64),
	radius_called_station_id String,
	radius_calling_station_id String,
	radius_acct_delay_time Int64,
	radius_acct_session_id String,
	radius_acct_multi_session_id String,
	radius_acct_input_octets Int64,
	radius_acct_output_octets Int64,
	radius_acct_input_packets Int64,
	radius_acct_output_packets Int64,
	radius_acct_session_time Int64,
	radius_acct_link_count Int64,
	radius_acct_interim_interval Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log ON CLUSTER ck_query (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log ON CLUSTER ck_query (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	doh_url String,
	doh_host String,
	doh_request_line String,
	doh_response_line String,
	doh_cookie String,
	doh_referer String,
	doh_user_agent String,
	doh_content_length String,
	doh_content_type String,
	doh_set_cookie String,
	doh_version String,
	doh_message_id Int64,
	doh_qr Int64,
	doh_opcode Int64,
	doh_aa Int64,
	doh_tc Int64,
	doh_rd Int64,
	doh_ra Int64,
	doh_rcode Int64,
	doh_qdcount Int64,
	doh_ancount Int64,
	doh_nscount Int64,
	doh_arcount Int64,
	doh_qname String,
	doh_qtype Int64,
	doh_qclass Int64,
	doh_cname String,
	doh_sub Int64,
	doh_rr String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_event_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log ON CLUSTER ck_query (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,security_event_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log ON CLUSTER ck_query (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	nic_name String,
	origin_source_mac String,
	origin_dest_mac String,
	packet_url String,
	pcap_storage_task_id Int64,
	pcap_storage_duration Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,sys_packet_capture_log_local,rand());
	

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log ON CLUSTER ck_query(
	event_timestamp Int64,
	account String,
	framed_ip String,
	acct_status_type Int64,
	acct_session_id String,
	acct_session_time Int64
)
ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_onff_log_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log ON CLUSTER ck_cluster (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	radius_packet_type Int64,
	radius_nas_ip String,
	radius_framed_ip String,
	radius_account String,
	radius_session_timeout Int64,
	radius_idle_timeout Int64,
	radius_acct_status_type Int64,
	radius_acct_terminate_cause Int64,
	radius_event_timestamp Int64,
	radius_nas_port Int64,
	radius_service_type Int64,
	radius_framed_protocol Int64,
	radius_callback_number String,
	radius_callback_id String,
	radius_termination_action Nullable(Int64),
	radius_called_station_id String,
	radius_calling_station_id String,
	radius_acct_delay_time Int64,
	radius_acct_session_id String,
	radius_acct_multi_session_id String,
	radius_acct_input_octets Int64,
	radius_acct_output_octets Int64,
	radius_acct_input_packets Int64,
	radius_acct_output_packets Int64,
	radius_acct_session_time Int64,
	radius_acct_link_count Int64,
	radius_acct_interim_interval Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log ON CLUSTER ck_cluster (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log ON CLUSTER ck_cluster (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	doh_url String,
	doh_host String,
	doh_request_line String,
	doh_response_line String,
	doh_cookie String,
	doh_referer String,
	doh_user_agent String,
	doh_content_length String,
	doh_content_type String,
	doh_set_cookie String,
	doh_version String,
	doh_message_id Int64,
	doh_qr Int64,
	doh_opcode Int64,
	doh_aa Int64,
	doh_tc Int64,
	doh_rd Int64,
	doh_ra Int64,
	doh_rcode Int64,
	doh_qdcount Int64,
	doh_ancount Int64,
	doh_nscount Int64,
	doh_arcount Int64,
	doh_qname String,
	doh_qtype Int64,
	doh_qclass Int64,
	doh_cname String,
	doh_sub Int64,
	doh_rr String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_event_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log ON CLUSTER ck_cluster (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	http_url String,
	http_host String,
	http_domain String,
	http_request_line String,
	http_response_line String,
	http_request_header String,
	http_response_header String,
	http_request_content String,
	http_response_content String,
	http_request_body String,
	http_response_body String,
	http_request_body_key String,
	http_response_body_key String,
	http_proxy_flag Int64,
	http_sequence Int64,
	http_snapshot String,
	http_cookie String,
	http_referer String,
	http_user_agent String,
	http_content_length String,
	http_content_type String,
	http_set_cookie String,
	http_version String,
	http_response_lantency_ms Int64,
	http_session_duration_ms Int64,
	http_action_file_size Int64,
	mail_protocol_type String,
	mail_account String,
	mail_to_cmd String,
	mail_from_cmd String,
	mail_from String,
	mail_to String,
	mail_cc String,
	mail_bcc String,
	mail_subject String,
	mail_subject_charset String,
	mail_content String,
	mail_content_charset String,
	mail_attachment_name String,
	mail_attachment_name_charset String,
	mail_attachment_content String,
	mail_eml_file String,
	mail_snapshot String,
	dns_message_id Int64,
	dns_qr Nullable(Int64),
	dns_opcode Nullable(Int64),
	dns_aa Int64,
	dns_tc Int64,
	dns_rd Int64,
	dns_ra Int64,
	dns_rcode Int64,
	dns_qdcount Int64,
	dns_ancount Int64,
	dns_nscount Int64,
	dns_arcount Int64,
	dns_qname String,
	dns_qtype Int64,
	dns_qclass Int64,
	dns_cname String,
	dns_sub Int64,
	dns_rr String,
	ssl_version String,
	ssl_sni String,
	ssl_san String,
	ssl_cn String,
	ssl_pinningst Nullable(Int64),
	ssl_intercept_state Nullable(Int64),
	ssl_server_side_latency Int64,
	ssl_client_side_latency Int64,
	ssl_server_side_version String,
	ssl_client_side_version String,
	ssl_cert_verify Nullable(Int64),
	ssl_error String,
	ssl_con_latency_ms Int64,
	ssl_ja3_fingerprint String,
	ssl_ja3_hash String,
	ssl_cert_issuer String,
	ssl_cert_subject String,
	quic_version String,
	quic_sni String,
	quic_user_agent String,
	ftp_account String,
	ftp_url String,
	ftp_content String,
	ftp_link_type String,
	bgp_type Int64,
	bgp_as_num String,
	bgp_route String,
	voip_calling_account String,
	voip_called_account String,
	voip_calling_number String,
	voip_called_number String,
	streaming_media_url String,
	streaming_media_protocol String,
	app_extra_info String,
	sip_call_id String,
	sip_originator_description String,
	sip_responder_description String,
	sip_user_agent String,
	sip_server String,
	sip_originator_sdp_connect_ip String,
	sip_originator_sdp_media_port Int64,
	sip_originator_sdp_media_type String,
	sip_originator_sdp_content String,
	sip_responder_sdp_connect_ip String,
	sip_responder_sdp_media_port Int64,
	sip_responder_sdp_media_type String,
	sip_responder_sdp_content String,
	sip_duration Int64,
	sip_bye String,
	rtp_payload_type_c2s Nullable(Int64),
	rtp_payload_type_s2c Nullable(Int64),
	rtp_pcap_path String,
	rtp_originator_dir Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,security_event_log_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log ON CLUSTER ck_cluster (
	common_recv_time Int64,
	common_log_id UInt64,
	common_stream_trace_id UInt64,
	common_direction Nullable(Int64),
	common_stream_dir Int64,
	common_start_time Int64,
	common_end_time Int64,
	common_con_duration_ms Int64,
	common_establish_latency_ms Int64,
	common_processing_time Int64,
	common_entrance_id Int64,
	common_device_id String,
	common_link_id Int64,
	common_isp String,
	common_data_center String,
	common_sled_ip String,
	common_action Int64,
	common_sub_action String,
	common_policy_id Int64,
	common_user_tags String,
	common_user_region String,
	common_client_ip String,
	common_internal_ip String,
	common_client_port Int64,
	common_client_location String,
	common_client_asn String,
	common_subscriber_id String,
	common_imei String,
	common_imsi String,
	common_phone_number String,
	common_server_ip String,
	common_external_ip String,
	common_server_port Int64,
	common_server_location String,
	common_server_asn String,
	common_app_id String,
	common_app_label String,
	common_app_surrogate_id String,
	common_l7_protocol String,
	common_protocol_label String,
	common_service_category Array(Int64),
	common_service Int64,
	common_l4_protocol String,
	common_sessions Int64,
	common_c2s_pkt_num Int64,
	common_s2c_pkt_num Int64,
	common_c2s_pkt_diff Int64,
	common_s2c_pkt_diff Int64,
	common_c2s_byte_num Int64,
	common_s2c_byte_num Int64,
	common_c2s_byte_diff Int64,
	common_s2c_byte_diff Int64,
	common_c2s_ipfrag_num Int64,
	common_s2c_ipfrag_num Int64,
	common_c2s_tcp_lostlen Int64,
	common_s2c_tcp_lostlen Int64,
	common_c2s_tcp_unorder_num Int64,
	common_s2c_tcp_unorder_num Int64,
	common_c2s_pkt_retrans Int64,
	common_s2c_pkt_retrans Int64,
	common_c2s_byte_retrans Int64,
	common_s2c_byte_retrans Int64,
	common_first_ttl Int64,
	common_tcp_client_isn Int64,
	common_tcp_server_isn Int64,
	common_address_type Int64,
	common_schema_type String,
	common_device_tag String,
	common_encapsulation Int64,
	common_tunnels String,
	common_address_list String,
	common_has_dup_traffic Int64,
	common_stream_error String,
	common_link_info_c2s String,
	common_link_info_s2c String,
	nic_name String,
	origin_source_mac String,
	origin_dest_mac String,
	packet_url String,
	pcap_storage_task_id Int64,
	pcap_storage_duration Int64
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,sys_packet_capture_log_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log ON CLUSTER ck_cluster(
	event_timestamp Int64,
	account String,
	framed_ip String,
	acct_status_type Int64,
	acct_session_id String,
	acct_session_time Int64
)
ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_onff_log_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip ON CLUSTER ck_cluster(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_client_ip_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip ON CLUSTER ck_cluster(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_server_ip_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id ON CLUSTER ck_cluster (
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_subscriber_id_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain ON CLUSTER ck_cluster(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_http_domain_local,rand());


CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip ON CLUSTER ck_query(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_client_ip_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip ON CLUSTER ck_query(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_server_ip_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id ON CLUSTER ck_query (
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_subscriber_id_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain ON CLUSTER ck_query(
	common_log_id UInt64,
	common_recv_time Int64,
	common_policy_id Int64,
	common_action Int64,
	common_server_ip String,
	common_client_ip String,
	common_sled_ip String,
	common_entrance_id Int64,
	common_subscriber_id String,
	common_stream_trace_id UInt64,
	http_domain String,
	ssl_sni  String
) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_http_domain_local,rand());

CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log_local on cluster ck_cluster(
common_log_id UInt64,
common_recv_time Int64,
common_entrance_id Int64,
common_device_id String,
common_link_id Int64,
common_policy_id Int64,
common_user_region String,
ad_method String,
ad_protocol String,
common_address_type Int64,
ad_target_ip String,
ad_target_port String,
ad_cc_target_url String,
ad_target_ip_location String,
ad_target_ip_asn String,
ad_claimed_src_ip_profile_id Int64,
ad_reflector_profile_id Int64,
ad_sent_pkt_num Int64,
ad_sent_byte_num Int64,
ad_cc_initiate_connection_num Int64,
ad_cc_established_connection_num Int64,
ad_cc_rejected_connection_num Int64,
ad_generate_time Int64
)
ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);

create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log on cluster ck_query(
common_log_id UInt64,
common_recv_time Int64,
common_entrance_id Int64,
common_device_id String,
common_link_id Int64,
common_policy_id Int64,
common_user_region String,
ad_method String,
ad_protocol String,
common_address_type Int64,
ad_target_ip String,
ad_target_port String,
ad_cc_target_url String,
ad_target_ip_location String,
ad_target_ip_asn String,
ad_claimed_src_ip_profile_id Int64,
ad_reflector_profile_id Int64,
ad_sent_pkt_num Int64,
ad_sent_byte_num Int64,
ad_cc_initiate_connection_num Int64,
ad_cc_established_connection_num Int64,
ad_cc_rejected_connection_num Int64,
ad_generate_time Int64
)
ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,active_defence_event_log_local,rand());

create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log on cluster ck_cluster(
common_log_id UInt64,
common_recv_time Int64,
common_entrance_id Int64,
common_device_id String,
common_link_id Int64,
common_policy_id Int64,
common_user_region String,
ad_method String,
ad_protocol String,
common_address_type Int64,
ad_target_ip String,
ad_target_port String,
ad_cc_target_url String,
ad_target_ip_location String,
ad_target_ip_asn String,
ad_claimed_src_ip_profile_id Int64,
ad_reflector_profile_id Int64,
ad_sent_pkt_num Int64,
ad_sent_byte_num Int64,
ad_cc_initiate_connection_num Int64,
ad_cc_established_connection_num Int64,
ad_cc_rejected_connection_num Int64,
ad_generate_time Int64
)
ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,active_defence_event_log_local,rand());


 CREATE TABLE IF NOT EXISTS `system`.tables_cluster ON CLUSTER ck_query as `system`.tables  ENGINE =Distributed(ck_all,`system`,tables,rand());
 CREATE TABLE IF NOT EXISTS `system`.disks_cluster ON CLUSTER ck_query as `system`.disks  ENGINE =Distributed(ck_all,`system`,disks,rand());
 CREATE TABLE IF NOT EXISTS `system`.parts_cluster ON CLUSTER ck_query as `system`.parts  ENGINE =Distributed(ck_all,`system`,parts,rand());
 CREATE TABLE IF NOT EXISTS `system`.query_log_cluster ON CLUSTER ck_query as `system`.query_log  ENGINE =Distributed(ck_all,`system`,query_log,rand());
 CREATE TABLE IF NOT EXISTS `system`.columns_cluster ON cluster ck_query AS `system`.columns ENGINE=Distributed(ck_all,`system`,columns,rand());
 

