diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 5fd104c..2ddb202 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -1,8 +1,184 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
   <component name="ChangeListManager">
-    <list default="true" id="55c8c5b9-9b57-431e-a0ed-0064b85979fa" name="Default Changelist" comment="">
+    <list default="true" id="55c8c5b9-9b57-431e-a0ed-0064b85979fa" name="Default Changelist" comment="1. 新增自动检测安装ansible(本地yum源的方式实现)&#10;2. storm替换flink(但是storm并未完全移除,可通过改变配置部署)&#10;3. 新增dos定时任务和dos数据流&#10;4. ck新增表, 服务镜像配置更新, druid新增任务/更新任务">
       <change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/README.md" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/install.sh" beforeDir="false" afterPath="$PROJECT_DIR$/install.sh" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/inventories/pro/group_vars/all" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/inventories/pro/hosts" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Arangodb.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Arangodb.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Clickhouse.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Clickhouse.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Druid.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Druid.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/HBase.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/HBase.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Hadoop.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Hadoop.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Kafka.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Kafka.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Mariadb.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Mariadb.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Nacos.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Nacos.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Spark.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Spark.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Storm.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Storm.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/Zookeeper.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/Zookeeper.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/check-components.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/check-components.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/check-services.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/check-services.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/environment.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/environment.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-chproxy.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-chproxy.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-gateway-keepalive.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-gateway-keepalive.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-gateway-nginx.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-gateway-nginx.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-gohangout.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-gohangout.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-hos-keepalive.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-hos-keepalive.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-hos-nginx.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-hos-nginx.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-hos-service.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-hos-service.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-job-service.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-job-service.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-qgw-service.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-qgw-service.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/galaxy-report-service.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/galaxy-report-service.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-clickhouse.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-clickhouse.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-druid.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-druid.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-galaxy-gateway-keepalive.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-galaxy-gateway-keepalive.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-galaxy-hos-service.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-galaxy-hos-service.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-galaxy-job-service.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-galaxy-job-service.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-hbase.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-hbase.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-kafka.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-kafka.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-spark.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-spark.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/init-storm.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/init-storm.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/menu/commonMenu" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/menu/commonMenu" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/menu/homePage" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/menu/homePage" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/check/check-components/tasks/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/check/check-components/tasks/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/check/check-services/tasks/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/check/check-services/tasks/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/arangodb/files/arangodb.tar.gz" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/arangodb/files/arangodb.tar.gz" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/arangodb/files/conf.bak.tar" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/arangodb/vars/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/arangodb/vars/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/clickhouse/common/tasks/install_clickhouse.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/clickhouse/common/tasks/install_clickhouse.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/clickhouse/common/templates/config.xml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/clickhouse/common/templates/config.xml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/clickhouse/common/templates/start_exporter.sh.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/clickhouse/common/templates/start_exporter.sh.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/clickhouse/common/vars/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/clickhouse/common/vars/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/clickhouse/data/tasks/install_clickhouse.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/clickhouse/data/tasks/install_clickhouse.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/clickhouse/data/vars/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/clickhouse/data/vars/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/clickhouse/query/vars/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/clickhouse/query/vars/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/druid/tasks/install_druid.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/druid/tasks/install_druid.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/druid/templates/keepdruidall.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/druid/templates/keepdruidall.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/hadoop/tasks/install_hadoop.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/hadoop/tasks/install_hadoop.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/components/mariadb/install-mariadb-cluster/tasks/install-mariadb.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/components/mariadb/install-mariadb-cluster/tasks/install-mariadb.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/clickhouse/templates/create_ck_table.sql" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/clickhouse/templates/create_ck_table.sql" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/clickhouse/templates/create_ck_table.sql_21.06" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/clickhouse/templates/dll.sql" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_segments-tsg-21.05.sql" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_segments-tsg3.0.sql" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_segments-tsg3.0.sql" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/initData.sh" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_client_internal_ip_hot_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_proxy_event_hits_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_proxy_event_urls_hot_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_security_event_hits_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_security_event_urls_hot_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_server_external_ip_hot_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_sys_storage_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_client_ip_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_external_host_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_internal_host_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_server_ip_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_urls_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_user_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_website_domain_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_app_stat_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_metrics_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_protocol_stat_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_summary_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_user_hot_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/init_website_domain_hot_log.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/initDruidData/tasks.txt" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/rule/common_task.txt" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/rule/common_task.txt" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/tasks/traffic_summary_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/tasks/traffic_summary_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/topology_list.txt" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/druid/files/druid_topology/topology_list.txt" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments.zip" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments.zip" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/client_internal_ip_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_39.273Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/proxy_event_hits_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_41.641Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/proxy_event_urls_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_43.849Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/security_event_hits_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_46.392Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/security_event_urls_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_48.458Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/server_external_ip_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_50.092Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/sys_storage_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_52.202Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/top_client_ip_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_53.675Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/top_external_host_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_55.845Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/top_internal_host_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_58.433Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/top_server_ip_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_59.654Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/top_urls_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_01.484Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/top_user_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_04.063Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/top_website_domain_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_06.100Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/traffic_app_stat_log/30000101T000000.000Z_30000102T000000.000Z/2021-07-02T02_43_09.615Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/traffic_metrics_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_08.462Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/traffic_protocol_stat_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_09.706Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/traffic_summary_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_12.193Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/user_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_14.350Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/files/segments/website_domain_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_16.425Z/0_index.zip" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/druid/templates/ingestionTask.sh.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/druid/templates/ingestionTask.sh.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/galaxy-job-service/templates/xxl_job.sql.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/galaxy-job-service/templates/xxl_job.sql.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/hbase/templates/create-hbase-table.sh.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/hbase/templates/create-hbase-table.sh.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/kafka/templates/create_topic.sh.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/kafka/templates/create_topic.sh.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/spark/templates/application.properties.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/spark/templates/application.properties.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/CONNECTION-RECORD-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/CONNECTION-RECORD-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/GTPC-RECORD-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/GTPC-RECORD-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/PROXY-EVENT-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/PROXY-EVENT-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/RADIUS-ON-OFF.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/RADIUS-ON-OFF.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/RADIUS-RECORD-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/RADIUS-RECORD-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/SECURITY-EVENT-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/SECURITY-EVENT-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/SUBSCRUBER-HBASE.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/SUBSCRUBER-HBASE.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/VOIP-RECORD-COMPLETED-LOG.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/VOIP-RECORD-COMPLETED-LOG.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/init/storm/templates/VOIP-RELATION.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/init/storm/templates/VOIP-RELATION.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-chproxy/templates/config.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-chproxy/templates/config.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gateway-keepalive/tasks/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gateway-keepalive/tasks/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gateway-keepalive/templates/kp_daemon.sh.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gateway-keepalive/templates/kp_daemon.sh.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/files/start_all.sh" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/files/start_all.sh" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/tasks/load_gohangout.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/tasks/load_gohangout.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_active_defence_event_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_active_defence_event_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_connection_record_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_connection_record_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_gtpc_record_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_gtpc_record_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_live_session_record_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_live_session_record_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_proxy_event_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_proxy_event_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_onff_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_onff_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_record_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_record_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_security_event_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_security_event_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_sys_packet_capture_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_sys_packet_capture_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_transaction_record_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_transaction_record_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_voip_record_log_tsgv3.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-gohangout/templates/k2ck_voip_record_log_tsgv3.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/templates/application.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/templates/application.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/templates/galaxy-hos-service.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/templates/galaxy-hos-service.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/templates/log4j2-dev.xml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/templates/log4j2-dev.xml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/templates/tmp/application.properties.j2" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/templates/tmp/galaxy-hos-service.j2" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/vars/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-hos-service/vars/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-job-service/templates/galaxy-job-executor.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-job-service/templates/galaxy-job-executor.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-job-service/templates/xxl_job.sql.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-job-service/templates/xxl_job.sql.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-job-service/vars/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-job-service/vars/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/ck-filter.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/ck-filter.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/ck-queries-template.sql" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/ck-queries-template.sql" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_client_ip.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_client_ip.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_server_ip.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_server_ip.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_subscriber_id.json" beforeDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_http_domain.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_http_domain.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/druid-filter.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/druid-filter.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/engine-filter.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/engine-filter.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/gtpc_record_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/gtpc_record_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_history.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_history.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_live.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_live.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/live_session_record_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/live_session_record_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/meta_data.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/meta_data.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/proxy_event_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/proxy_event_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/radius_record_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/radius_record_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/security_event_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/security_event_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/sys_packet_capture_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/sys_packet_capture_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/transaction_record_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/transaction_record_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/version.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/version.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/voip_record_log.json" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/files/config/voip_record_log.json" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/templates/galaxy-qgw-service.yml.j2" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/templates/galaxy-qgw-service.yml.j2" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/vars/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/roles/services/galaxy-qgw-service/vars/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/test.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/test.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/parcels/test1.yml" beforeDir="false" afterPath="$PROJECT_DIR$/parcels/test1.yml" afterDir="false" />
     </list>
     <option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
     <option name="SHOW_DIALOG" value="false" />
@@ -15,20 +191,8 @@
       <file pinned="false" current-in-tab="true">
         <entry file="file://$PROJECT_DIR$/install.sh">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="330">
-              <caret line="22" column="10" lean-forward="true" selection-start-line="22" selection-start-column="10" selection-end-line="22" selection-end-column="10" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/README.md">
-          <provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
-            <state split_layout="FIRST">
-              <first_editor relative-caret-position="960">
-                <caret line="64" column="27" selection-start-line="64" selection-start-column="27" selection-end-line="64" selection-end-column="27" />
-              </first_editor>
-              <second_editor />
+            <state relative-caret-position="689">
+              <caret line="53" column="22" lean-forward="true" selection-start-line="53" selection-start-column="22" selection-end-line="53" selection-end-column="22" />
             </state>
           </provider>
         </entry>
@@ -65,6 +229,11 @@
               <item name="Galaxy-auto-deploy-cluster" type="b2602c69:ProjectViewProjectNode" />
               <item name="Galaxy-auto-deploy-cluster" type="462c0819:PsiDirectoryNode" />
             </path>
+            <path>
+              <item name="Galaxy-auto-deploy-cluster" type="b2602c69:ProjectViewProjectNode" />
+              <item name="Galaxy-auto-deploy-cluster" type="462c0819:PsiDirectoryNode" />
+              <item name="parcels" type="462c0819:PsiDirectoryNode" />
+            </path>
           </expand>
           <select />
         </subPane>
@@ -104,17 +273,28 @@
       <workItem from="1629364020595" duration="323000" />
       <workItem from="1629365110577" duration="847000" />
       <workItem from="1629771678937" duration="537000" />
+      <workItem from="1629774458891" duration="812000" />
+      <workItem from="1629854869947" duration="503000" />
+      <workItem from="1630466216768" duration="33000" />
+      <workItem from="1630466362401" duration="562000" />
     </task>
+    <task id="LOCAL-00001" summary="1. 新增自动检测安装ansible(本地yum源的方式实现)&#10;2. 抽取后的变量放回各自的roles中(因不想对客户暴露)&#10;3. clickhous初始化脚本关于bifang-maridb的部分变量化&#10;4. 修复一些小bug">
+      <created>1629774644583</created>
+      <option name="number" value="00001" />
+      <option name="presentableId" value="LOCAL-00001" />
+      <option name="project" value="LOCAL" />
+      <updated>1629774644583</updated>
+    </task>
+    <option name="localTasksCounter" value="2" />
     <servers />
   </component>
   <component name="TimeTrackingManager">
-    <option name="totallyTimeSpent" value="1707000" />
+    <option name="totallyTimeSpent" value="3617000" />
   </component>
   <component name="ToolWindowManager">
     <frame x="0" y="0" width="2560" height="1440" extended-state="0" />
-    <editor active="true" />
     <layout>
-      <window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.25377283" />
+      <window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.26171565" />
       <window_info id="Structure" order="1" side_tool="true" weight="0.25" />
       <window_info id="Favorites" order="2" side_tool="true" />
       <window_info anchor="bottom" id="Message" order="0" />
@@ -140,19 +320,23 @@
   <component name="TypeScriptGeneratedFilesManager">
     <option name="version" value="1" />
   </component>
+  <component name="VcsManagerConfiguration">
+    <MESSAGE value="1. 新增自动检测安装ansible(本地yum源的方式实现)&#10;2. 抽取后的变量放回各自的roles中(因不想对客户暴露)&#10;3. clickhous初始化脚本关于bifang-maridb的部分变量化&#10;4. 修复一些小bug" />
+    <option name="LAST_COMMIT_MESSAGE" value="1. 新增自动检测安装ansible(本地yum源的方式实现)&#10;2. 抽取后的变量放回各自的roles中(因不想对客户暴露)&#10;3. clickhous初始化脚本关于bifang-maridb的部分变量化&#10;4. 修复一些小bug" />
+  </component>
   <component name="editorHistoryManager">
     <entry file="file://$PROJECT_DIR$/install.sh">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="330">
-          <caret line="22" column="10" lean-forward="true" selection-start-line="22" selection-start-column="10" selection-end-line="22" selection-end-column="10" />
+        <state relative-caret-position="689">
+          <caret line="53" column="22" lean-forward="true" selection-start-line="53" selection-start-column="22" selection-end-line="53" selection-end-column="22" />
         </state>
       </provider>
     </entry>
     <entry file="file://$PROJECT_DIR$/README.md">
       <provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
-        <state split_layout="FIRST">
-          <first_editor relative-caret-position="960">
-            <caret line="64" column="27" selection-start-line="64" selection-start-column="27" selection-end-line="64" selection-end-column="27" />
+        <state split_layout="SECOND">
+          <first_editor relative-caret-position="1005">
+            <caret line="67" column="10" selection-start-line="67" selection-start-column="10" selection-end-line="67" selection-end-column="10" />
           </first_editor>
           <second_editor />
         </state>
diff --git a/README.md b/README.md
deleted file mode 100644
index fdc39d1..0000000
--- a/README.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# 使用手册
-
-[TOC]
-
-## 目录结构
-
-Galaxy-auto-deploy-cluster-21.07
-├── inventories
-│   └── pro
-│       ├── group_vars
-│       └── hosts
-├── parcels
-│   ├── menu
-│   │   ├── appMenu
-│   │   ├── commonMenu
-│   │   └── homePage
-│   ├── roles
-│   │   ├── check
-│   │   ├── components
-│   │   ├── dependencies
-│   │   ├── init
-│   │   └── services
-│   ├── Arangodb.yml
-│   ├── check-components.yml
-│   ├── check-services.yml
-│   ├── Clickhouse.yml
-│   ├── Druid.yml
-│   ├── environment.yml
-│   ├── galaxy-chproxy.yml
-│   ├── galaxy-gateway-keepalive.yml
-│   ├── galaxy-gateway-nginx.yml
-│   ├── galaxy-gohangout.yml
-│   ├── galaxy-hos-keepalive.yml
-│   ├── galaxy-hos-nginx.yml
-│   ├── galaxy-hos-service.yml
-│   ├── galaxy-job-service.yml
-│   ├── galaxy-qgw-service.yml
-│   ├── galaxy-report-service.yml
-│   ├── Hadoop.yml
-│   ├── HBase.yml
-│   ├── init-clickhouse.yml
-│   ├── init-druid.yml
-│   ├── init-galaxy-gateway-keepalive.yml
-│   ├── init-galaxy-hos-service.yml
-│   ├── init-galaxy-job-service.yml
-│   ├── init-hbase.yml
-│   ├── init-kafka.yml
-│   ├── init-spark.yml
-│   ├── init-storm.yml
-│   ├── Kafka.yml
-│   ├── Mariadb.yml
-│   ├── Nacos.yml
-│   ├── Spark.yml
-│   ├── Storm.yml
-│   ├── test1.yml
-│   ├── test.yml
-│   └── Zookeeper.yml
-├── software_packages
-
-
-## 纪要
-
-- 主机ip配置文件
-inventories/pro/hosts
-
-- 所有role(主机)使用的变量
-inventories/pro/group_vars/all
-`注意`: 新增变量名不可与已有变量发生重复
-
-- 部署包目录
-software_packages
-为方便管理, 将相关部署包和镜像移到software_packages文件夹下(避免大文件上传gitlab)
-
-
-## 使用说明
-
-1. 配置 inventories/pro/hosts 部署组件的主机
-
-2. 视情况修改 inventories/pro/group_vars/all 里的相关配置
-
-3. 确认好配置后执行 "sh install.sh" 进行安装
diff --git a/inventories/pro/group_vars/all b/configurations/components.yml
similarity index 50%
rename from inventories/pro/group_vars/all
rename to configurations/components.yml
index f6ff059..24a0ada 100644
--- a/inventories/pro/group_vars/all
+++ b/configurations/components.yml
@@ -1,110 +1,3 @@
-#######################
-####               ####
-####    基础配置   ####
-####               ####
-#######################
-#============================基础配置===============================#
-#根据对应的地区修改;默认为东八区，若为东六区，则修改为:"+06:00"
-local_time: "+08:00"
-
-#若使用本安装包安装jdk，则此配置无需更改；若使用其他安装包或已安装过，则指向已有的jdk安装目录
-java_home: /usr/lib/jvm/jdk1.8.0_73
-
-#统一安装路径
-install_path: /home/ceiec
-
-#数据存储路径，包含数据和日志
-data_path: /home/ceiec
-
-#若安装过程中检测到对应组件已存在，是否允许脚本卸载已存在的组件。
-#仅限本安装包部署的组件。
-allowed_unload: "yes"
-
-# 所有安装包路径,可自己指定绝对路径
-package_path: "{{ playbook_dir | dirname }}/software_packages"
-#package_path: /opt/software_packages
-
-#============================bifang-Mariadb===============================#
-
-#Bifang MariaDB 地址，用于galaxy-qgw-service、galaxy-report-service的业务使用。
-bifang_mariadb_host: 192.168.40.153
-
-#Bifang mariadb 端口
-bifang_mariadb_port: 3306
-
-#Bifang mariadb 数据库名
-bifang_mariadb_database: tsg-bifang
-
-#Bifang mariadb pin
-bifang_mariadb_pin: 111111
-
-#galaxy mariadb key
-galaxy_mariadb_pin: ceiec2019
-
-
-#============================虚IP===============================#
-
-#-------------apps------------------#
-
-#Galaxy 业务组件keepalive IP地址,填写的IP只能是和hosts-services配置的IP是同段的，且不能跟同段内已有的IP相同。
-gateway_keepalive_host: 192.168.45.252
-
-#Galaxy 业务组件keepalive绑定网卡名称，不支持两个服务器网卡名称不同的情况，此情况需要安装完成后手动修改配置文件
-gateway_keepalive_interface: eth0
-
-#Galaxy 业务组件keepalive router_id 注意同网段内此值不可重复
-gateway_keepalive_router_id: 61
-
-#-------------hos------------------#
-#是否需要对hos配置keepalive，若不需要则此处为no，若需要则为yes
-#此项配置用于在服务器较少环境下，不对galaxy-hos-service服务单独做负载均衡的情况。
-hos_keepalive_need: "yes"
-
-#galaxy-hos-service服务keepalive IP地址 若 hos_keepalive_need为no，则此处填写gateway_keepalive_host对应的IP
-#填写的IP只能是和hosts-hoskeepalive配置的IP是同段的，且不能跟同段内已有的IP相同。
-hos_keepalive_host: 192.168.45.253
-
-#galaxy-hos-service服务keepalive绑定网卡名称，不支持两个服务器网卡名称不同的情况，此情况需要安装完成后手>动修改配置文件
-#若 hos_keepalive_need 配置no则此处 可不进行修改
-hos_keepalive_interface: eth0
-
-#galaxy-hos-service服务keepalive router_id 注意同网段内此值不可重复
-#若 hos_keepalive_need 配置no则此处 可不进行修改
-hos_keepalive_router_id: 62
-
-
-
-#============================Kafka===============================#
-#任务消费kafka地址,若无特殊情况为本安装集群kafka地址，格式:kafkaip1:9092,kafkaip2:9092,kafkaip3:9092.....
-consumer_kafka_servers: 192.168.45.37:9092,192.168.45.38:9092,192.168.45.39:9092
-
-#任务结果写入kafka地址,若无特殊情况为本安装集群kafka地址，格式:kafkaip1:9092,kafkaip2:9092,kafkaip3:9092.....
-producer_kafka_servers: 192.168.45.37:9092,192.168.45.38:9092,192.168.45.39:9092
-
-#============================默认配置===============================#
-#自研服务组件使用nacos 命名空间名称
-services_config_namespace: prod
-
-#Galaxy的 Nacos pin
-nacos_pin: nacos
-
-#Nacos 使用的mariadb 数据库名称
-mariadb_nacos_database: nacos
-
-#Druid 使用的mariadb 数据库名称
-mariadb_druid_database: druid
-
-#galaxy-job-service依赖的MariaDB数据库名称
-mariadb_job_database: xxl_job
-
-
-
-
-########################
-#####               ####
-#####    组件配置   ####
-#####               ####
-########################
 #===========================druid===============================#
 #druid服务使用磁盘最大大小，若druid单独使用服务器则配置，服务器可用空间的 75%，单位 字节
 #原配置名称：druid.server.maxSize
@@ -229,6 +122,9 @@ topic_file_bytes: 1073741824
 #缓冲池字节大小 单位，单位：MB
 mariadb_innodb_buffer_pool_size: 1024
 
+#galaxy mariadb key
+galaxy_mariadb_pin: galaxy2019
+
 #===========================Spark===============================#
 #spark worker 节点内存，单位：MB
 spark_worker_mem: 512
@@ -250,6 +146,21 @@ storm_worker_max_mem: 1024
 #单个worker内存大小，单位：MB 
 storm_worker_min_mem: 1024
 
+
+#===========================Flink================================#
+#网络缓存大小
+taskmanager_memory_network_min: 512m
+taskmanager_memory_network_max: 1280m
+
+#taskmanager堆外内存
+taskmanager_memory_managed_size: 256m
+
+#TaskManager进程占用的所有与Flink相关的内存
+taskmanager_memory_flink_size: 5120m
+
+#JobManager进程占用的所有与Flink相关的内存
+jobmanager_memory_flink_size: 1024m
+
 #===========================Zookeeper===============================#
 #zookeeper 进程 启动内存大小 单位MB
 zookeeper_max_mem: 1024
@@ -261,30 +172,3 @@ galaxy_mariadb_port: 3306
 #mariadb 用户
 galaxy_mariadb_username: root
 
-
-
-########################
-#####               ####
-#####    业务配置   ####
-#####               ####
-########################
-#=======================galaxy-hos-service==========================#
-#galaxy-hos-service服务 tomcat缓存大小,单位KB
-hos_tomcat_cache_size: 100000
-
-#galaxy-hos-service 服务内存设置
-hos_java_opts: "-Xmx512m -Xms512m -Xmn512m"
-
-#=======================galaxy-qgw-service==========================#
-#galaxy-qgw-service 服务内存设置
-qgw_java_opts: "-Xmx512m -Xms512m"
-
-#=======================galaxy-job-service==========================#
-#galaxy-job-service 服务内存设置
-job_java_opts: "-Xmx512m -Xms512m"
-
-#======================galaxy-report-service=========================#
-#galaxy-report-service 服务内存设置
-report_java_opts: "-Xmx512m -Xms512m"
-
-
diff --git a/configurations/config.yml b/configurations/config.yml
new file mode 100644
index 0000000..1ee5618
--- /dev/null
+++ b/configurations/config.yml
@@ -0,0 +1,91 @@
+#============================基础配置===============================#
+#根据对应的地区修改;默认为东八区，若为东六区，则修改为:"+06:00"
+local_time: "+08:00"
+
+#若使用本安装包安装jdk，则此配置无需更改；若使用其他安装包或已安装过，则指向已有的jdk安装目录
+java_home: /usr/lib/jvm/jdk1.8.0_73
+
+#统一安装路径
+install_path: /home/galaxy
+
+#数据存储路径，包含数据和日志
+data_path: /home/galaxy
+
+#若安装过程中检测到对应组件已存在，是否允许脚本卸载已存在的组件。
+#仅限本安装包部署的组件。
+allowed_unload: "yes"
+
+# 所有安装包路径,可自己指定绝对路径
+package_path: "{{ playbook_dir | dirname }}/software_packages"
+#package_path: /opt/software_packages
+
+#============================bifang-Mariadb===============================#
+
+#Bifang MariaDB 地址，用于galaxy-qgw-service、galaxy-report-service、flink-dos的业务使用。
+bifang_mariadb_host: 192.168.40.153
+
+#Bifang mariadb 端口
+bifang_mariadb_port: 3306
+
+#Bifang mariadb 数据库名
+bifang_mariadb_database: tsg-bifang
+
+#Bifang mariadb root's pin
+bifang_mariadb_pin: 111111
+
+#============================虚IP===============================#
+
+#-------------apps------------------#
+
+#Galaxy 业务组件keepalive IP地址,填写的IP只能是和hosts-services配置的IP是同段的，且不能跟同段内已有的IP相同。
+gateway_keepalive_host: 192.168.45.252
+
+#Galaxy 业务组件keepalive绑定网卡名称，不支持两个服务器网卡名称不同的情况，此情况需要安装完成后手动修改配置文件
+gateway_keepalive_interface: eth0
+
+#Galaxy 业务组件keepalive router_id 注意同网段内此值不可重复
+gateway_keepalive_router_id: 61
+
+#-------------hos------------------#
+#是否需要对hos配置keepalive，若不需要则此处为no，若需要则为yes
+#此项配置用于在服务器较少环境下，不对galaxy-hos-service服务单独做负载均衡的情况。
+hos_keepalive_need: "yes"
+
+#galaxy-hos-service服务keepalive IP地址 若 hos_keepalive_need为no，则此处填写gateway_keepalive_host对应的IP
+#填写的IP只能是和hosts-hoskeepalive配置的IP是同段的，且不能跟同段内已有的IP相同。
+hos_keepalive_host: 192.168.45.253
+
+#galaxy-hos-service服务keepalive绑定网卡名称，不支持两个服务器网卡名称不同的情况，此情况需要安装完成后手>动修改配置文件
+#若 hos_keepalive_need 配置no则此处 可不进行修改
+hos_keepalive_interface: eth0
+
+#galaxy-hos-service服务keepalive router_id 注意同网段内此值不可重复
+#若 hos_keepalive_need 配置no则此处 可不进行修改
+hos_keepalive_router_id: 62
+
+#============================clickhouse===============================#
+#ssd磁盘挂载的目录, 如果没有ssd磁盘可选择一块普通磁盘
+clickhouse_ssd_path: /ssd_data/clickhouse/
+
+#============================Kafka===============================#
+#任务消费kafka地址,若无特殊情况为本安装集群kafka地址，格式:kafkaip1:9092,kafkaip2:9092,kafkaip3:9092.....
+kafka_source_servers: 192.168.45.37:9092,192.168.45.38:9092,192.168.45.39:9092
+
+#任务结果写入kafka地址,若无特殊情况为本安装集群kafka地址，格式:kafkaip1:9092,kafkaip2:9092,kafkaip3:9092.....
+kafka_sink_servers: 192.168.45.37:9092,192.168.45.38:9092,192.168.45.39:9092
+
+#============================默认配置===============================#
+#自研服务组件使用nacos 命名空间名称
+services_config_namespace: prod
+
+#Galaxy的 Nacos pin
+nacos_pin: nacos
+
+#Nacos 使用的mariadb 数据库名称
+mariadb_nacos_database: nacos
+
+#Druid 使用的mariadb 数据库名称
+mariadb_druid_database: druid
+
+#galaxy-job-service依赖的MariaDB数据库名称
+mariadb_job_database: xxl_job
diff --git a/inventories/pro/hosts b/configurations/hosts
similarity index 90%
rename from inventories/pro/hosts
rename to configurations/hosts
index 93a3060..5065ea5 100644
--- a/inventories/pro/hosts
+++ b/configurations/hosts
@@ -45,7 +45,13 @@
 192.168.45.39
 
 #此标签指定的IP用于：Apache Storm的安装，根据内部约定，若集群整体小于3台则第一台为numbus节点；大于三台则前三台为nimbus节点。
-[storm]
+#[storm]
+#192.168.45.37
+#192.168.45.38
+#192.168.45.39
+
+#此标签指定的IP用于：Apache Flink的安装，根据内部约定，前两台台为master节点；所有节点为worker节点。
+[flink]
 192.168.45.37
 192.168.45.38
 192.168.45.39
@@ -84,3 +90,8 @@
 192.168.45.41
 192.168.45.42
 192.168.45.43
+
+#dos检测的离线generate-baseline程序
+[dos_baseline]
+192.168.45.43
+
diff --git a/configurations/services.yml b/configurations/services.yml
new file mode 100644
index 0000000..39cf4ad
--- /dev/null
+++ b/configurations/services.yml
@@ -0,0 +1,18 @@
+#=======================galaxy-hos-service==========================#
+#galaxy-hos-service服务 tomcat缓存大小,单位KB
+hos_tomcat_cache_size: 100000
+
+#galaxy-hos-service 服务内存设置
+hos_java_opts: "-Xmx512m -Xms512m -Xmn512m"
+
+#=======================galaxy-qgw-service==========================#
+#galaxy-qgw-service 服务内存设置
+qgw_java_opts: "-Xmx512m -Xms512m"
+
+#=======================galaxy-job-service==========================#
+#galaxy-job-service 服务内存设置
+job_java_opts: "-Xmx512m -Xms512m"
+
+#======================galaxy-report-service=========================#
+#galaxy-report-service 服务内存设置
+report_java_opts: "-Xmx512m -Xms512m"
diff --git a/install.sh b/install.sh
index c34fb53..b1e42d2 100755
--- a/install.sh
+++ b/install.sh
@@ -60,7 +60,7 @@ if [[ $hasAnsible != '0' ]]; then
   else
     mv /etc/yum.repos.d/bak_`date '+%Y-%m-%d'`/* /etc/yum.repos.d/
     rm -r /etc/yum.repos.d/bak_`date '+%Y-%m-%d'`
-    echo -e "\033[32;1mThis Ansible not installed, please check it manually\033[0m"
+    echo -e "\033[32;1mThis Ansible install failed, please check it manually\033[0m"
     exit 1
   fi
 else
@@ -79,7 +79,7 @@ function checkCluster() {
 clear
 echo "Check the environment to be deployed, including JDK, PIP, Docker, Firewall, TimeZone if not installed"
 sleep 2
-ansible-playbook -i ../inventories/pro/hosts environment.yml
+ansible-playbook -i ../configurations/hosts environment.yml
 if [ $? -eq '0' ];then
   clear
   echo -e "\033[32;1mEnvironmental check complete, ready for installation\033[0m"
@@ -150,7 +150,7 @@ NAME=$1
 
 is=`getrecordnum $NAME`
 if [ $is -lt '1' ];then
-   ansible-playbook -i ../inventories/pro/hosts $NAME.yml
+   ansible-playbook -i ../configurations/hosts $NAME.yml
     if [ $? -eq '0' ];then
       sleep 10
 	  echoSuccess $NAME
@@ -165,7 +165,7 @@ else
     read -p "y/Y 继续执行安装,n/N 返回选择菜单：" yn
     case $yn in
     [Yy]*) 
-      ansible-playbook -i ../inventories/pro/hosts $NAME.yml
+      ansible-playbook -i ../configurations/hosts $NAME.yml
       if [ $? -eq '0' ];then
         sleep 10
 		echoSuccess $NAME
@@ -193,13 +193,15 @@ function installAllCommon() {
 clear
 
 i=0
-ins_names=(Zookeeper Mariadb galaxy-gateway-keepalive Nacos Kafka Storm Hadoop HBase Clickhouse Druid Spark Arangodb)
+#ins_names=(Zookeeper Mariadb galaxy-gateway-keepalive Nacos Kafka Storm Hadoop HBase Clickhouse Druid Spark Arangodb)
+#替换Storm成Flink
+ins_names=(Zookeeper Mariadb galaxy-gateway-keepalive Nacos Kafka Flink Hadoop HBase Clickhouse Druid Spark Arangodb)
 echo ${ins_names[@]} > $NUM_DIR/common_list
 
 #根据组合进行顺序安装
 for element in ${ins_names[@]}
 do
-  ansible-playbook -i ../inventories/pro/hosts $element.yml
+  ansible-playbook -i ../configurations/hosts $element.yml
   if [ $? -eq '0' ];then
     sleep 10
 	echoSuccess $element
@@ -232,7 +234,7 @@ read -p "y/Y 继续执行安装,n/N 返回选择菜单：" yn
     oldnums=${#ins_names[*]}
       for element in ${ins_names[@]}
       do
-        ansible-playbook -i ../inventories/pro/hosts $element.yml
+        ansible-playbook -i ../configurations/hosts $element.yml
         if [ $? -eq '0' ];then
         sleep 10
 		echoSuccess $element
@@ -267,7 +269,9 @@ done
 function installcombination() {
 
 if [ -f $NUM_DIR/common_list ];then
-  if [ `cat $NUM_DIR/common_list | egrep "Mariadb|Nacos|Zookeeper|galaxy-gateway-keepalive|Kafka|Storm|Hadoop|HBase|Clickhouse|Druid|Spark|Arangodb" | wc -l` -gt '0' ]
+  #if [ `cat $NUM_DIR/common_list | egrep "Mariadb|Nacos|Zookeeper|galaxy-gateway-keepalive|Kafka|Storm|Hadoop|HBase|Clickhouse|Druid|Spark|Arangodb" | wc -l` -gt '0' ]
+  #替换Storm成Flink
+  if [ `cat $NUM_DIR/common_list | egrep "Mariadb|Nacos|Zookeeper|galaxy-gateway-keepalive|Kafka|Flink|Hadoop|HBase|Clickhouse|Druid|Spark|Arangodb" | wc -l` -gt '0' ]
   then
     abnormalCombination
   else
@@ -289,7 +293,7 @@ NAME=$1
 
 is=`getrecordnum $NAME`
 if [ $is -lt '1' ];then
-   ansible-playbook -i ../inventories/pro/hosts $NAME.yml
+   ansible-playbook -i ../configurations/hosts $NAME.yml
     if [ $? -eq '0' ];then
       sleep 10
 	  echoSuccess $NAME
@@ -304,7 +308,7 @@ else
     read -p "y/Y 继续执行安装,n/N 返回选择菜单：" yn
     case $yn in
     [Yy]*) 
-      ansible-playbook -i ../inventories/pro/hosts $NAME.yml
+      ansible-playbook -i ../configurations/hosts $NAME.yml
       if [ $? -eq '0' ];then
         sleep 10
 		echoSuccess $NAME
@@ -332,7 +336,7 @@ function installAllApps() {
 clear
 
 i=0
-hoskeep=`cat ../inventories/pro/group_vars/all | grep -vE "^#|^$" | grep "hos_keepalive_need" | grep yes | wc -l`
+hoskeep=`cat ../configurations/config.yml | grep -vE "^#|^$" | grep "hos_keepalive_need" | grep yes | wc -l`
 if [[ $hoskeep -eq "1" ]]; then
   ins_names=(galaxy-gateway-nginx galaxy-qgw-service galaxy-job-service galaxy-report-service galaxy-hos-service galaxy-chproxy galaxy-hos-nginx galaxy-hos-keepalive galaxy-gohangout)
 else
@@ -343,7 +347,7 @@ echo ${ins_names[@]} > $NUM_DIR/app_list
 #根据组合进行顺序安装
 for element in ${ins_names[@]}
 do
-  ansible-playbook -i ../inventories/pro/hosts $element.yml
+  ansible-playbook -i ../configurations/hosts $element.yml
   if [ $? -eq '0' ];then
     sleep 10
 	echoSuccess $element
@@ -376,7 +380,7 @@ read -p "y/Y 继续执行安装,n/N 返回选择菜单：" yn
     oldnums=${#ins_names[*]}
       for element in ${ins_names[@]}
       do
-        ansible-playbook -i ../inventories/pro/hosts $element.yml
+        ansible-playbook -i ../configurations/hosts $element.yml
         if [ $? -eq '0' ];then
         sleep 10
 		echoSuccess $element
@@ -430,13 +434,15 @@ function initAll() {
 clear
 
 i=0
-ins_names=(init-galaxy-gateway-keepalive init-kafka init-hbase init-druid init-clickhouse init-storm init-spark init-galaxy-hos-service)
+#ins_names=(init-galaxy-gateway-keepalive init-kafka init-hbase init-druid init-clickhouse init-storm init-spark init-galaxy-hos-service init-dos)
+#替换init-storm成init-flink
+ins_names=(init-galaxy-gateway-keepalive init-kafka init-hbase init-druid init-clickhouse init-flink init-spark init-galaxy-hos-service init-dos)
 echo ${ins_names[@]} > $NUM_DIR/init_list
 
 #根据组合进行顺序安装
 for element in ${ins_names[@]}
 do
-  ansible-playbook -i ../inventories/pro/hosts $element.yml
+  ansible-playbook -i ../configurations/hosts $element.yml
   if [ $? -eq '0' ];then
     sleep 10
 	echoSuccess $element
@@ -470,7 +476,7 @@ read -p "y/Y 继续执行安装,n/N 返回选择菜单：" yn
     oldnums=${#ins_names[*]}
       for element in ${ins_names[@]}
       do
-        ansible-playbook -i ../inventories/pro/hosts $element.yml
+        ansible-playbook -i ../configurations/hosts $element.yml
         if [ $? -eq '0' ];then
         sleep 10
 		echoSuccess $element
@@ -503,7 +509,10 @@ done
 function installInit() {
 
 if [ -f $NUM_DIR/init_list ];then
-  if [ `cat $NUM_DIR/init_list | egrep "init-galaxy-gateway-keepalive|init-kafka|init-hbase|init-druid|init-clickhouse|init-storm|init-spark|init-galaxy-job-service|init-galaxy-hos-service" | wc -l` -gt '0' ]
+  
+  #if [ `cat $NUM_DIR/init_list | egrep "init-galaxy-gateway-keepalive|init-kafka|init-hbase|init-druid|init-clickhouse|init-storm|init-spark|init-galaxy-job-service|init-galaxy-hos-service|init-dos" | wc -l` -gt '0' ]
+  #替换init-storm成init-flink
+  if [ `cat $NUM_DIR/init_list | egrep "init-galaxy-gateway-keepalive|init-kafka|init-hbase|init-druid|init-clickhouse|init-flink|init-spark|init-galaxy-job-service|init-galaxy-hos-service|init-dos" | wc -l` -gt '0' ]
   then
     abnormalInit
   else
@@ -529,7 +538,7 @@ echo ${ins_names[@]} > $NUM_DIR/check_list
 #根据组合进行顺序安装
 for element in ${ins_names[@]}
 do
-  ansible-playbook -i ../inventories/pro/hosts $element.yml
+  ansible-playbook -i ../configurations/hosts $element.yml
   if [ $? -eq '0' ];then
    echoSuccess $element
    unset ins_names[$i]
@@ -566,7 +575,7 @@ read -p "y/Y 继续执行安装,n/N 返回选择菜单：" yn
     oldnums=${#ins_names[*]}
       for element in ${ins_names[@]}
       do
-        ansible-playbook -i ../inventories/pro/hosts $element.yml
+        ansible-playbook -i ../configurations/hosts $element.yml
         if [ $? -eq '0' ];then
         sleep 10
 		echoSuccess $element
diff --git a/parcels/Arangodb.yml b/parcels/Arangodb.yml
index 4358560..177d394 100644
--- a/parcels/Arangodb.yml
+++ b/parcels/Arangodb.yml
@@ -2,7 +2,7 @@
   remote_user: root
   roles:
    - components/arangodb
-#  vars_files:
-#    - ../configurations/config.yml
-#    - ../configurations/components.yml
-#    - roles/components/arangodb/vars/main.yml
+  vars_files:
+    - ../configurations/config.yml
+    - ../configurations/components.yml
+    - roles/components/arangodb/vars/main.yml
diff --git a/parcels/Clickhouse.yml b/parcels/Clickhouse.yml
index 4e5c75c..238b727 100644
--- a/parcels/Clickhouse.yml
+++ b/parcels/Clickhouse.yml
@@ -3,26 +3,26 @@
   remote_user: root
   roles:
    - components/clickhouse/common
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - roles/components/clickhouse/common/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - roles/components/clickhouse/common/vars/main.yml
 
 - hosts: clickhouse
   remote_user: root
   roles:
    - components/clickhouse/query
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - roles/components/clickhouse/common/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - roles/components/clickhouse/common/vars/main.yml
 
 - hosts: clickhouse
   remote_user: root
   roles:
    - components/clickhouse/data
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - roles/components/clickhouse/common/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - roles/components/clickhouse/common/vars/main.yml
 
diff --git a/parcels/Druid.yml b/parcels/Druid.yml
index d2bd21a..741bcab 100644
--- a/parcels/Druid.yml
+++ b/parcels/Druid.yml
@@ -2,7 +2,7 @@
   remote_user: root
   roles:
    - components/druid
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - roles/components/druid/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - roles/components/druid/vars/main.yml
diff --git a/parcels/Flink.yml b/parcels/Flink.yml
new file mode 100644
index 0000000..e00eaa3
--- /dev/null
+++ b/parcels/Flink.yml
@@ -0,0 +1,11 @@
+
+- hosts: flink
+  remote_user: root
+  roles:
+   - components/flink
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/flink/vars/main.yml
+
diff --git a/parcels/HBase.yml b/parcels/HBase.yml
index 248d4be..602b313 100644
--- a/parcels/HBase.yml
+++ b/parcels/HBase.yml
@@ -2,9 +2,9 @@
   remote_user: root
   roles:
    - components/hbase
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/hbase/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/hbase/vars/main.yml
 
diff --git a/parcels/Hadoop.yml b/parcels/Hadoop.yml
index ea24036..c371509 100644
--- a/parcels/Hadoop.yml
+++ b/parcels/Hadoop.yml
@@ -2,10 +2,10 @@
   remote_user: root
   roles:
    - components/hadoop
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/hadoop/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/hadoop/vars/main.yml
 
 
diff --git a/parcels/Kafka.yml b/parcels/Kafka.yml
index a67f0ee..5dcda24 100644
--- a/parcels/Kafka.yml
+++ b/parcels/Kafka.yml
@@ -3,9 +3,9 @@
   remote_user: root
   roles:
    - components/kafka
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/kafka/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/kafka/vars/main.yml
 
diff --git a/parcels/Mariadb.yml b/parcels/Mariadb.yml
index 5e05084..c19cd8a 100644
--- a/parcels/Mariadb.yml
+++ b/parcels/Mariadb.yml
@@ -3,18 +3,18 @@
   remote_user: root
   roles:
    - components/mariadb/install-mariadb-cluster
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/mariadb/install-mariadb-cluster/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/mariadb/install-mariadb-cluster/vars/main.yml
 
 - hosts: mariadb
   remote_user: root
   roles:
    - components/mariadb/mariadb-double-master
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/mariadb/install-mariadb-cluster/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/mariadb/install-mariadb-cluster/vars/main.yml
diff --git a/parcels/Nacos.yml b/parcels/Nacos.yml
index 6ebfd98..6217150 100644
--- a/parcels/Nacos.yml
+++ b/parcels/Nacos.yml
@@ -3,8 +3,8 @@
   remote_user: root
   roles:
    - components/nacos
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/nacos/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/nacos/vars/main.yml
diff --git a/parcels/Spark.yml b/parcels/Spark.yml
index 2f6a874..3563480 100644
--- a/parcels/Spark.yml
+++ b/parcels/Spark.yml
@@ -3,8 +3,8 @@
   remote_user: root
   roles:
    - components/spark
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/spark/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/spark/vars/main.yml
diff --git a/parcels/Storm.yml b/parcels/Storm.yml
index c06dcff..2f6f29f 100644
--- a/parcels/Storm.yml
+++ b/parcels/Storm.yml
@@ -3,9 +3,9 @@
   remote_user: root
   roles:
    - components/storm
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/storm/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/storm/vars/main.yml
 
diff --git a/parcels/Zookeeper.yml b/parcels/Zookeeper.yml
index 5c454b3..643e676 100644
--- a/parcels/Zookeeper.yml
+++ b/parcels/Zookeeper.yml
@@ -4,9 +4,9 @@
 #  max_fail_percentage: 0
   roles:
    - components/zookeeper
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/zookeeper/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/zookeeper/vars/main.yml
 
diff --git a/parcels/check-components.yml b/parcels/check-components.yml
index 9e97bd1..7c1a094 100644
--- a/parcels/check-components.yml
+++ b/parcels/check-components.yml
@@ -2,5 +2,5 @@
   remote_user: root
   roles:
    - check/check-components
-#  vars_files:
-#   - ../configurations/config.yml
+  vars_files:
+   - ../configurations/config.yml
diff --git a/parcels/check-services.yml b/parcels/check-services.yml
index b23a79b..6f58c49 100644
--- a/parcels/check-services.yml
+++ b/parcels/check-services.yml
@@ -2,5 +2,5 @@
   remote_user: root
   roles:
    - check/check-services
-#  vars_files:
-#   - ../configurations/config.yml
+  vars_files:
+   - ../configurations/config.yml
diff --git a/parcels/environment.yml b/parcels/environment.yml
index 8c8b1d1..d72dca0 100644
--- a/parcels/environment.yml
+++ b/parcels/environment.yml
@@ -3,9 +3,9 @@
   remote_user: root
   roles:
    - dependencies/install-jdk
-#  vars_files:
-#   - roles/dependencies/install-jdk/vars/main.yml
-#   - ../configurations/config.yml
+  vars_files:
+   - roles/dependencies/install-jdk/vars/main.yml
+   - ../configurations/config.yml
 
 #安装pip和docker
 - hosts: all
@@ -13,13 +13,13 @@
   roles:
    - dependencies/install-docker
    - dependencies/install-pip
-#  vars_files:
-#   - ../configurations/config.yml
+  vars_files:
+   - ../configurations/config.yml
 
 - hosts: all
   remote_user: root
   roles:
    - dependencies/check-env
-#  vars_files:
-#   - roles/dependencies/check-env/vars/main.yml
-#   - ../configurations/config.yml
+  vars_files:
+   - roles/dependencies/check-env/vars/main.yml
+   - ../configurations/config.yml
diff --git a/parcels/galaxy-chproxy.yml b/parcels/galaxy-chproxy.yml
index cacd5fa..510dfb0 100644
--- a/parcels/galaxy-chproxy.yml
+++ b/parcels/galaxy-chproxy.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - services/galaxy-chproxy
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-chproxy/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-chproxy/vars/main.yml
diff --git a/parcels/galaxy-gateway-keepalive.yml b/parcels/galaxy-gateway-keepalive.yml
index aced81b..ec7af92 100644
--- a/parcels/galaxy-gateway-keepalive.yml
+++ b/parcels/galaxy-gateway-keepalive.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - services/galaxy-gateway-keepalive
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-gateway-keepalive/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-gateway-keepalive/vars/main.yml
diff --git a/parcels/galaxy-gateway-nginx.yml b/parcels/galaxy-gateway-nginx.yml
index 5ec6fd0..4d2efc5 100644
--- a/parcels/galaxy-gateway-nginx.yml
+++ b/parcels/galaxy-gateway-nginx.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - services/galaxy-gateway-nginx
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-gateway-nginx/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-gateway-nginx/vars/main.yml
diff --git a/parcels/galaxy-gohangout.yml b/parcels/galaxy-gohangout.yml
index f23615b..29f37a2 100644
--- a/parcels/galaxy-gohangout.yml
+++ b/parcels/galaxy-gohangout.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - services/galaxy-gohangout
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-gohangout/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-gohangout/vars/main.yml
diff --git a/parcels/galaxy-hos-keepalive.yml b/parcels/galaxy-hos-keepalive.yml
index feda7d4..4a6ff54 100644
--- a/parcels/galaxy-hos-keepalive.yml
+++ b/parcels/galaxy-hos-keepalive.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - services/galaxy-hos-keepalive
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-hos-keepalive/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-hos-keepalive/vars/main.yml
diff --git a/parcels/galaxy-hos-nginx.yml b/parcels/galaxy-hos-nginx.yml
index 3520610..9fc815b 100644
--- a/parcels/galaxy-hos-nginx.yml
+++ b/parcels/galaxy-hos-nginx.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - services/galaxy-hos-nginx
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-hos-nginx/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-hos-nginx/vars/main.yml
diff --git a/parcels/galaxy-hos-service.yml b/parcels/galaxy-hos-service.yml
index 94b8bab..9559f68 100644
--- a/parcels/galaxy-hos-service.yml
+++ b/parcels/galaxy-hos-service.yml
@@ -2,9 +2,9 @@
   remote_user: root
   roles:
    - services/galaxy-hos-service
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-hos-service/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-hos-service/vars/main.yml
 
diff --git a/parcels/galaxy-job-service.yml b/parcels/galaxy-job-service.yml
index 6c2f018..f8b1479 100644
--- a/parcels/galaxy-job-service.yml
+++ b/parcels/galaxy-job-service.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - services/galaxy-job-service
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-job-service/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-job-service/vars/main.yml
diff --git a/parcels/galaxy-qgw-service.yml b/parcels/galaxy-qgw-service.yml
index 300caca..036a2b5 100644
--- a/parcels/galaxy-qgw-service.yml
+++ b/parcels/galaxy-qgw-service.yml
@@ -2,9 +2,9 @@
   remote_user: root
   roles:
    - services/galaxy-qgw-service
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-qgw-service/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-qgw-service/vars/main.yml
 
diff --git a/parcels/galaxy-report-service.yml b/parcels/galaxy-report-service.yml
index 89cb4ae..1ac580a 100644
--- a/parcels/galaxy-report-service.yml
+++ b/parcels/galaxy-report-service.yml
@@ -2,9 +2,9 @@
   remote_user: root
   roles:
    - services/galaxy-report-service
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-report-service/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-report-service/vars/main.yml
 
diff --git a/parcels/init-clickhouse.yml b/parcels/init-clickhouse.yml
index 55538f3..bdfddb7 100644
--- a/parcels/init-clickhouse.yml
+++ b/parcels/init-clickhouse.yml
@@ -3,8 +3,8 @@
   remote_user: root
   roles:
    - init/clickhouse
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/clickhouse/common/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/clickhouse/common/vars/main.yml
diff --git a/parcels/init-dos.yml b/parcels/init-dos.yml
new file mode 100644
index 0000000..aa86169
--- /dev/null
+++ b/parcels/init-dos.yml
@@ -0,0 +1,9 @@
+- hosts: 
+   - dos_baseline
+  remote_user: root
+  roles:
+   - init/dos-baseline
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
diff --git a/parcels/init-druid.yml b/parcels/init-druid.yml
index e31e6e2..52d93f0 100644
--- a/parcels/init-druid.yml
+++ b/parcels/init-druid.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - init/druid
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/druid/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/druid/vars/main.yml
diff --git a/parcels/init-flink.yml b/parcels/init-flink.yml
new file mode 100644
index 0000000..f7fd5fd
--- /dev/null
+++ b/parcels/init-flink.yml
@@ -0,0 +1,10 @@
+- hosts:
+   - flink
+  remote_user: root
+  roles:
+   - init/flink
+  vars_files:
+   - roles/components/flink/vars/main.yml
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
diff --git a/parcels/init-galaxy-gateway-keepalive.yml b/parcels/init-galaxy-gateway-keepalive.yml
index 8e2f6f7..32eb539 100644
--- a/parcels/init-galaxy-gateway-keepalive.yml
+++ b/parcels/init-galaxy-gateway-keepalive.yml
@@ -2,8 +2,11 @@
   remote_user: root
   roles:
    - init/galaxy-gateway-keepalive
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-gateway-keepalive/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-gateway-keepalive/vars/main.yml
+   - roles/services/galaxy-qgw-service/vars/main.yml
+   - roles/services/galaxy-chproxy/vars/main.yml
+   - roles/services/galaxy-gateway-nginx/vars/main.yml
diff --git a/parcels/init-galaxy-hos-service.yml b/parcels/init-galaxy-hos-service.yml
index e0fa1b9..814ebb7 100644
--- a/parcels/init-galaxy-hos-service.yml
+++ b/parcels/init-galaxy-hos-service.yml
@@ -2,8 +2,8 @@
   remote_user: root
   roles:
    - init/galaxy-hos-service
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-hos-service/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-hos-service/vars/main.yml
diff --git a/parcels/init-galaxy-job-service.yml b/parcels/init-galaxy-job-service.yml
index 8ee4b82..5046e3f 100644
--- a/parcels/init-galaxy-job-service.yml
+++ b/parcels/init-galaxy-job-service.yml
@@ -3,8 +3,8 @@
   remote_user: root
   roles:
    - init/galaxy-job-service
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/services/galaxy-job-service/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/services/galaxy-job-service/vars/main.yml
diff --git a/parcels/init-hbase.yml b/parcels/init-hbase.yml
index 3d2d9bc..e622a8d 100644
--- a/parcels/init-hbase.yml
+++ b/parcels/init-hbase.yml
@@ -3,8 +3,8 @@
   remote_user: root
   roles:
    - init/hbase
-#  vars_files:
-#   - roles/components/hbase/vars/main.yml
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
+  vars_files:
+   - roles/components/hbase/vars/main.yml
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
diff --git a/parcels/init-kafka.yml b/parcels/init-kafka.yml
index c13bc82..d47b9cd 100644
--- a/parcels/init-kafka.yml
+++ b/parcels/init-kafka.yml
@@ -3,8 +3,8 @@
   remote_user: root
   roles:
    - init/kafka
-#  vars_files:
-#   - roles/components/kafka/vars/main.yml
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
+  vars_files:
+   - roles/components/kafka/vars/main.yml
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
diff --git a/parcels/init-spark.yml b/parcels/init-spark.yml
index 1ddba8a..2cd6661 100644
--- a/parcels/init-spark.yml
+++ b/parcels/init-spark.yml
@@ -3,8 +3,8 @@
   remote_user: root
   roles:
    - init/spark
-#  vars_files:
-#   - roles/components/spark/vars/main.yml
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
+  vars_files:
+   - roles/components/spark/vars/main.yml
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
diff --git a/parcels/init-storm.yml b/parcels/init-storm.yml
index 3b41866..935502d 100644
--- a/parcels/init-storm.yml
+++ b/parcels/init-storm.yml
@@ -3,8 +3,8 @@
   remote_user: root
   roles:
    - init/storm
-#  vars_files:
-#   - roles/components/storm/vars/main.yml
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
+  vars_files:
+   - roles/components/storm/vars/main.yml
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
diff --git a/parcels/menu/commonMenu b/parcels/menu/commonMenu
index e688de4..8bf158b 100644
--- a/parcels/menu/commonMenu
+++ b/parcels/menu/commonMenu
@@ -5,7 +5,7 @@ Open Source Software：
   ├      [*]  Mariadb              ┤
   ├      [*]  Nacos                ┤
   ├      [*]  Apache Kafka         ┤
-  ├      [*]  Apache Storm         ┤
+  ├      [*]  Apache Flink         ┤
   ├      [*]  Apache Hadoop        ┤
   ├      [*]  Apache HBase         ┤
   ├      [*]  Clickhouse           ┤
diff --git a/parcels/menu/homePage b/parcels/menu/homePage
index 0873861..72d2ad1 100644
--- a/parcels/menu/homePage
+++ b/parcels/menu/homePage
@@ -1,4 +1,4 @@
-Galaxy Data Platform Cluster - TSG21.06
+Galaxy Data Platform Cluster - TSG21.08
 
  Please choose one of the following: 
                     
diff --git a/parcels/roles/check/check-components/tasks/main.yml b/parcels/roles/check/check-components/tasks/main.yml
index 1971dfa..aa3bd1b 100644
--- a/parcels/roles/check/check-components/tasks/main.yml
+++ b/parcels/roles/check/check-components/tasks/main.yml
@@ -1,15 +1,22 @@
-- name: Checking Strom Topology Num
-  shell: "source /etc/profile && storm list | grep 'ACTIVE' | wc -l"
-  register: stormlist
+#- name: Checking Strom Topology Num
+#  shell: "source /etc/profile && storm list | grep 'ACTIVE' | wc -l"
+#  register: stormlist
+#  run_once: true
+#  delegate_to: '{{ groups.storm[0] }}'
+
+- name: Checking Flink Topology Num
+  shell: "source /etc/profile && flink list | grep 'RUNNING' | wc -l"
+  register: flinklist
   run_once: true
-  delegate_to: '{{ groups.storm[0] }}'
+  delegate_to: '{{ groups.flink[0] }}'
+
 
 - name: Checking Strom Topology Num
   fail:
-    msg: "storm 提交任务数量与版本对应任务数量不匹配，请检查"
-  when: stormlist.stdout < '15'
+    msg: "flink 提交任务数量与版本对应任务数量不匹配，请检查"
+  when: flinklist.stdout < '16'
   run_once: true
-  delegate_to: '{{ groups.storm[0] }}'
+  delegate_to: '{{ groups.flink[0] }}'
 
 - name: Checking Gohangout Num
   shell: "ps -ef | grep gohangout | grep worker | grep -v grep | wc -l"
@@ -20,6 +27,6 @@
 - name: Checking Gohangout Num
   fail:
     msg: "Gohangout 任务启动数据量与版本对应任务数量不匹配，请检查"
-  when: golist.stdout < '10'
+  when: golist.stdout < '12'
   run_once: true
   delegate_to: '{{ groups.gohangout[0] }}'
diff --git a/parcels/roles/check/check-services/tasks/main.yml b/parcels/roles/check/check-services/tasks/main.yml
index 58261f2..4e5f0ad 100644
--- a/parcels/roles/check/check-services/tasks/main.yml
+++ b/parcels/roles/check/check-services/tasks/main.yml
@@ -60,7 +60,7 @@
 
 - fail:
     msg: "{{ inventory_hostname }}- gohangout start job num is not all. Please check it"
-  when: check_out.stdout < '10'
+  when: check_out.stdout < '12'
   run_once: true
   delegate_facts: true
   delegate_to: '{{ groups.gohangout[1] }}'
diff --git a/parcels/roles/components/arangodb/files/README.md b/parcels/roles/components/arangodb/files/README.md
new file mode 100644
index 0000000..a5e7791
--- /dev/null
+++ b/parcels/roles/components/arangodb/files/README.md
@@ -0,0 +1,3 @@
+#权限
+- 账户: query
+- 密码: galaxy2018
diff --git a/parcels/roles/components/arangodb/files/arangodb.tar.gz b/parcels/roles/components/arangodb/files/arangodb.tar.gz
index b65fe06..7d978ad 100644
Binary files a/parcels/roles/components/arangodb/files/arangodb.tar.gz and b/parcels/roles/components/arangodb/files/arangodb.tar.gz differ
diff --git a/parcels/roles/components/arangodb/files/conf.bak.tar b/parcels/roles/components/arangodb/files/conf.bak.tar
deleted file mode 100644
index a7c7bb8..0000000
Binary files a/parcels/roles/components/arangodb/files/conf.bak.tar and /dev/null differ
diff --git a/parcels/roles/components/arangodb/vars/main.yml b/parcels/roles/components/arangodb/vars/main.yml
index a0d83bc..f36d5ae 100644
--- a/parcels/roles/components/arangodb/vars/main.yml
+++ b/parcels/roles/components/arangodb/vars/main.yml
@@ -1,5 +1,5 @@
 #注意这里面定义的key中不能包含减号-,否则程序无法识别定义的key
-arangodb_password: ceiec2018
+arangodb_password: galaxy2018
 
 #离线模式下使用:bifang-api的docker镜像文件名称,在../file中的文件名称
 arangodb_image_tar_name: arangodb-3.6.4.tar
diff --git a/parcels/roles/components/clickhouse/common/tasks/install_clickhouse.yml b/parcels/roles/components/clickhouse/common/tasks/install_clickhouse.yml
index 0fb6599..cfecc83 100644
--- a/parcels/roles/components/clickhouse/common/tasks/install_clickhouse.yml
+++ b/parcels/roles/components/clickhouse/common/tasks/install_clickhouse.yml
@@ -1,3 +1,8 @@
+- name: create {{ install_path }}
+  file:
+    state: directory
+    path: '{{ install_path }}'
+
 - name: Check whether the CPU supports the SSE4_2 instruction set
   shell: lscpu |grep sse4_2 | wc -l
   register: check_cpu_out
@@ -17,7 +22,7 @@
         force: true
         mode: 0755
       when: check_out.stdout >= '1'
-    - name: unload kafka
+    - name: unload clickhouse
       shell: cd {{ install_path }} && sh unload_ck.sh
       when: check_out.stdout >= '1'
     - name: Ansible delete {{ install_path }}/unload_ck.sh
@@ -59,6 +64,11 @@
   run_once: true
   delegate_to: 127.0.0.1
 
+- name: create clickhouse ssd data path:{{ clickhouse_ssd_path }}
+  file:
+    state: directory
+    path: '{{ clickhouse_ssd_path }}'
+
 - name: create clickhouse package path:{{ install_path }}/clickhouse
   file:
     state: directory
diff --git a/parcels/roles/components/clickhouse/common/templates/config.xml.j2 b/parcels/roles/components/clickhouse/common/templates/config.xml.j2
index fe3ddc4..3366c88 100644
--- a/parcels/roles/components/clickhouse/common/templates/config.xml.j2
+++ b/parcels/roles/components/clickhouse/common/templates/config.xml.j2
@@ -368,6 +368,28 @@
       -->
     <format_schema_path>{{ install_path }}/clickhouse/format_schemas/</format_schema_path>
 
+    <storage_configuration>
+        <disks>
+            <ssd>
+              <path>{{ clickhouse_ssd_path }}</path>
+            </ssd>
+        </disks>
+
+        <policies>
+            <ssd_to_hdd>
+              <volumes>
+                <hot>
+                  <disk>ssd</disk>
+                </hot>
+                <default>
+                    <disk>default</disk>
+                 </default>
+              </volumes>
+              <move_factor>0.1</move_factor>
+            </ssd_to_hdd>
+        </policies>
+    </storage_configuration>
+
     <!-- Uncomment to disable ClickHouse internal DNS caching. -->
     <!-- <disable_internal_dns_cache>1</disable_internal_dns_cache> -->
 </yandex>
diff --git a/parcels/roles/components/clickhouse/common/templates/start_exporter.sh.j2 b/parcels/roles/components/clickhouse/common/templates/start_exporter.sh.j2
index a16e3b5..44ce360 100755
--- a/parcels/roles/components/clickhouse/common/templates/start_exporter.sh.j2
+++ b/parcels/roles/components/clickhouse/common/templates/start_exporter.sh.j2
@@ -6,4 +6,4 @@ docker rm -f clickhouse_exporter
 
 sleep 3
 
-docker run -d -p 9904:9116 --name clickhouse_exporter --restart always --env CLICKHOUSE_USER=default --env CLICKHOUSE_PASSWORD=ceiec2019 clickhouse-exporter:v1.0 -scrape_uri=http://{{ inventory_hostname }}:8123/
+docker run -d -p 9904:9116 --name clickhouse_exporter --restart always --env CLICKHOUSE_USER=default --env CLICKHOUSE_PASSWORD=galaxy2019 clickhouse-exporter:v1.0 -scrape_uri=http://{{ inventory_hostname }}:8123/
diff --git a/parcels/roles/components/clickhouse/common/vars/main.yml b/parcels/roles/components/clickhouse/common/vars/main.yml
index d9cd341..3514434 100644
--- a/parcels/roles/components/clickhouse/common/vars/main.yml
+++ b/parcels/roles/components/clickhouse/common/vars/main.yml
@@ -5,7 +5,7 @@ clickhouse_version: 20.3.12.112
 default_database: default
 
 #clickhouse 只读key
-readonly_key: ceiec2018
+readonly_key: galaxy2018
 
 #clickhouse 管理key
-root_key: ceiec2019
+root_key: galaxy2019
diff --git a/parcels/roles/components/clickhouse/data/tasks/install_clickhouse.yml b/parcels/roles/components/clickhouse/data/tasks/install_clickhouse.yml
index 2571627..47dd7b4 100644
--- a/parcels/roles/components/clickhouse/data/tasks/install_clickhouse.yml
+++ b/parcels/roles/components/clickhouse/data/tasks/install_clickhouse.yml
@@ -38,7 +38,7 @@
   when: odbc_install.stdout != '0' and inventory_hostname != (groups.clickhouse[0]) and inventory_hostname != (groups.clickhouse[1])
 
 - name: set dir user
-  shell: chown clickhouse:clickhouse -R {{ data_path }}/clickhouse/
+  shell: chown clickhouse:clickhouse -R {{ data_path }}/clickhouse/ && chown clickhouse:clickhouse -R {{ clickhouse_ssd_path }}
   when: inventory_hostname != (groups.clickhouse[0]) and inventory_hostname != (groups.clickhouse[1])
 
 - name: copy clickhouse-server to /etc/init.d/
diff --git a/parcels/roles/components/clickhouse/data/vars/main.yml b/parcels/roles/components/clickhouse/data/vars/main.yml
index d9cd341..3514434 100644
--- a/parcels/roles/components/clickhouse/data/vars/main.yml
+++ b/parcels/roles/components/clickhouse/data/vars/main.yml
@@ -5,7 +5,7 @@ clickhouse_version: 20.3.12.112
 default_database: default
 
 #clickhouse 只读key
-readonly_key: ceiec2018
+readonly_key: galaxy2018
 
 #clickhouse 管理key
-root_key: ceiec2019
+root_key: galaxy2019
diff --git a/parcels/roles/components/clickhouse/query/vars/main.yml b/parcels/roles/components/clickhouse/query/vars/main.yml
index d9cd341..3514434 100644
--- a/parcels/roles/components/clickhouse/query/vars/main.yml
+++ b/parcels/roles/components/clickhouse/query/vars/main.yml
@@ -5,7 +5,7 @@ clickhouse_version: 20.3.12.112
 default_database: default
 
 #clickhouse 只读key
-readonly_key: ceiec2018
+readonly_key: galaxy2018
 
 #clickhouse 管理key
-root_key: ceiec2019
+root_key: galaxy2019
diff --git a/parcels/roles/components/druid/tasks/install_druid.yml b/parcels/roles/components/druid/tasks/install_druid.yml
index 8a2900a..a1ce1a7 100644
--- a/parcels/roles/components/druid/tasks/install_druid.yml
+++ b/parcels/roles/components/druid/tasks/install_druid.yml
@@ -38,7 +38,7 @@
         force: true
         mode: 0755
       when: check_out.stdout >= '1'
-    - name: unload kafka
+    - name: unload Druid
       shell: cd {{ install_path }} && sh unload_druid.sh
       when: check_out.stdout >= '1'
     - name: check if {{ mariadb_druid_database }} exist
diff --git a/parcels/roles/components/druid/templates/keepdruidall.j2 b/parcels/roles/components/druid/templates/keepdruidall.j2
index 071008d..0892183 100644
--- a/parcels/roles/components/druid/templates/keepdruidall.j2
+++ b/parcels/roles/components/druid/templates/keepdruidall.j2
@@ -20,14 +20,15 @@ fi
 ;;
 
 stop)
-keeppid=`ps -ef | grep dae-druid-all.sh | grep -v grep | awk '{print $2}'`
-echo "守护进程PID：$keeppid"
-kill -9 $keeppid
+ps -ef | grep dae-druid-all.sh | grep -v grep | awk '{print $2}' | xargs kill -9 2>/dev/null
+#keeppid=`ps -ef | grep dae-druid-all.sh | grep -v grep | awk '{print $2}' | xargs kill -9 2>/dev/null`
+#echo "守护进程PID：$keeppid"
+#kill -9 $keeppid
 echo "关闭所有druid进程"
 #ps aux | grep druid | grep -v grep | awk '{print $2}' | xargs kill -9
 livenum=`ps -ef |grep "druid" | grep -v grep | grep -v json | wc -l`
 if [ $livenum -ne 0 ];then
-ps aux|grep "druid" |grep -v grep | awk '{print $2}'| xargs kill -9
+ps aux|grep "druid" |grep -v grep | awk '{print $2}'| xargs kill -9 2>/dev/null
 fi
 ;;
 
diff --git a/parcels/roles/components/flink/tasks/install_flink.yml b/parcels/roles/components/flink/tasks/install_flink.yml
new file mode 100644
index 0000000..4c2331b
--- /dev/null
+++ b/parcels/roles/components/flink/tasks/install_flink.yml
@@ -0,0 +1,127 @@
+- name: partion_nums to ansible variable
+  set_fact: partion_nums="{{groups.flink|length}}"
+
+- name: judge the machine number of flink
+  fail:
+    msg: "flink 集群最少需要配置3个节点，请修改configurations/hosts内对应IP列表。"
+  when: partion_nums < '3'
+  
+- name: check jdk 1.8_73
+  shell: source /etc/profile && java -version 2>&1 | grep 1.8.0_73 | wc -l
+  ignore_errors: false
+  register: jdk_out
+
+- name: To terminate execution
+  fail:
+    msg: "检测到目标集群内存在JDK未安装节点，请检查"
+  when: jdk_out.stdout != '2'
+  run_once: true
+  delegate_to: 127.0.0.1
+
+- name: create flink package path:{{ install_path }}
+  file:
+    state: directory
+    path: '{{ install_path }}'
+
+- block:
+    - name: Check if the flink service already exists
+      shell: source /etc/profile && jps -l | grep "org.apache.flink.runtime" | grep -v grep |awk '{print $1}' | wc -l
+      register: check_out
+    - name: copy unload_flink.sh to {{ install_path }}/
+      template: 
+        src: 'unload_flink.sh.j2'
+        dest: '{{ install_path }}/unload_flink.sh'
+        force: true
+        mode: 0755
+      when: check_out.stdout >= '1'
+    - name: unload flink
+      shell: cd {{ install_path }} && sh unload_flink.sh
+      when: check_out.stdout >= '1'
+    - name: Ansible delete {{ install_path }}/unload_flink.sh
+      file:
+        path: "{{ install_path }}/unload_flink.sh"
+        state: absent
+    - name: Check if the flink service already exists
+      shell: source /etc/profile && jps -l | grep "org.apache.flink.runtime" | grep -v grep |awk '{print $1}' | wc -l
+      register: check_out
+    - name: To terminate execution
+      fail:
+       msg: "卸载失败，组件可能非本安装部署，请手动卸载后继续安装"
+      run_once: true
+      delegate_to: 127.0.0.1 
+      when: check_out.stdout >= '1'        
+  when: (allowed_unload) == "yes"
+
+- block:
+    - name: Check if flink service already exists
+      shell: source /etc/profile && jps -l | grep "org.apache.flink.runtime" | grep -v grep |awk '{print $1}' | wc -l
+      register: check_out
+    - name: To terminate execution
+      fail:
+       msg: "检测到目标集群内已有flink请检查IP是否正确或停止/卸载已启动的组件"
+      run_once: true
+      delegate_to: 127.0.0.1 
+      when: check_out.stdout >= '1'
+  when: (allowed_unload) == "no"  
+
+- name: get zookeeper_servers to ansible variable
+  set_fact: zookeeper_servers="{{groups.zookeeper[0]}}:2181,{{groups.zookeeper[1]}}:2181,{{groups.zookeeper[2]}}:2181"
+  when: '(groups.zookeeper|length) == 3'
+  
+- name: get zookeeper_servers to ansible variable
+  set_fact: zookeeper_servers="{{groups.zookeeper[0]}}:2181,{{groups.zookeeper[1]}}:2181,{{groups.zookeeper[2]}}:2181,{{groups.zookeeper[3]}}:2181,{{groups.zookeeper[4]}}:2181"
+  when: '(groups.zookeeper|length) >= 5'
+
+#解压tar
+- name: unpack {{ flink_version }}.tgz
+  unarchive: 
+    src: '{{ package_path }}/{{ flink_version }}.tgz'
+    dest: '{{ install_path }}/'
+
+- name: Config flink configuration
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    mode: 0644
+  with_items:
+    - { src: 'flink-conf.yaml.j2', dest: '{{ install_path }}/{{ flink_version }}/conf/flink-conf.yaml' }
+    - { src: 'masters.j2', dest: '{{ install_path }}/{{ flink_version }}/conf/masters' }
+    - { src: 'workers.j2', dest: '{{ install_path }}/{{ flink_version }}/conf/workers' }
+
+
+- name: Config masters
+  lineinfile:
+    dest: "{{ install_path }}/{{ flink_version }}/conf/masters"
+    line: "{{ item }}:{{ flink_web_port }}"
+  with_items:
+    - '{{groups.flink[0]}}'
+    - '{{groups.flink[1]}}'
+
+
+- name: Config workers
+  lineinfile:
+    dest: "{{ install_path }}/{{ flink_version }}/conf/workers"
+    line: "{{ item }}"
+  loop: "{{ groups.flink|list }}"
+
+- name: Config flink scripts
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    mode: 0755
+  with_items:
+    - { src: 'set_flink_env.sh.j2', dest: '{{ install_path }}/{{ flink_version }}/bin/set_flink_env.sh' }
+    - { src: 'dae-flink.sh.j2', dest: '{{ install_path }}/{{ flink_version }}/bin/dae-flink.sh' }
+    - { src: 'keepflinkalive.j2', dest: '/etc/init.d/keepflinkalive' }
+
+#配置环境变量
+- name: set flink env and chkconfig keepflinkalive
+  shell: cd {{ install_path }}/{{ flink_version }}/bin/ && ./set_flink_env.sh
+
+#启动flink守护
+- name: start keepflinkalive service
+  shell: source /etc/profile && sh /etc/init.d/keepflinkalive start
+  when: hostvars[inventory_hostname]['ansible_env'].SSH_CONNECTION.split(' ')[2] == groups.flink[0]
+
+
+
diff --git a/parcels/roles/components/flink/tasks/main.yml b/parcels/roles/components/flink/tasks/main.yml
new file mode 100644
index 0000000..07d3520
--- /dev/null
+++ b/parcels/roles/components/flink/tasks/main.yml
@@ -0,0 +1 @@
+- include: install_flink.yml
diff --git a/parcels/roles/components/flink/templates/dae-flink.sh.j2 b/parcels/roles/components/flink/templates/dae-flink.sh.j2
new file mode 100755
index 0000000..5c78bd4
--- /dev/null
+++ b/parcels/roles/components/flink/templates/dae-flink.sh.j2
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+#修改BASE_DIR为安装的路径
+#启动命令端口可自行指定
+#JMX_PORT=9191 nohup $BASE_DIR/bin/kafka-server-start.sh $BASE_DIR/config/server.properties > /dev/null 2>&1 &
+
+PRO_NAME=flink
+BASE_DIR={{ install_path }}
+VERSION={{ flink_version }}
+source /etc/profile
+
+if [ ! -f "$BASE_DIR/$VERSION/log/restart_sum.log" ]
+then
+    touch $BASE_DIR/$VERSION/log/restart_sum.log
+    echo '0' > $BASE_DIR/$VERSION/log/restart_sum.log
+
+fi
+
+
+
+
+function start_flink(){
+while true ; do
+    NUM=`ps aux | grep -w ${PRO_NAME} | grep -vE "grep|dae-flink" |wc -l`
+    if [ "${NUM}" -lt "1" ];then
+        cd $BASE_DIR/$VERSION/
+        bin/start-cluster.sh
+        OLD_NUM=`cat $BASE_DIR/$VERSION/log/restart_sum.log`
+        RESTART_NUM=`expr $OLD_NUM + 1`
+        echo $RESTART_NUM > $BASE_DIR/$VERSION/log/restart_sum.log
+        echo "`date "+%Y-%m-%d %H:%M:%S"` - flink服务启动/异常重启 - 重启次数 -> $RESTART_NUM" >> $BASE_DIR/$VERSION/log/restart.log
+    fi
+        sleep 60s
+done
+}
+
+
+
+start_flink
diff --git a/parcels/roles/components/flink/templates/flink-conf.yaml.j2 b/parcels/roles/components/flink/templates/flink-conf.yaml.j2
new file mode 100644
index 0000000..ca0c962
--- /dev/null
+++ b/parcels/roles/components/flink/templates/flink-conf.yaml.j2
@@ -0,0 +1,306 @@
+censed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+
+#==============================================================================
+# Common
+#==============================================================================
+
+# The external address of the host on which the JobManager runs and can be
+# reached by the TaskManagers and any clients which want to connect. This setting
+# is only used in Standalone mode and may be overwritten on the JobManager side
+# by specifying the --host <hostname> parameter of the bin/jobmanager.sh executable.
+# In high availability mode, if you use the bin/start-cluster.sh script and setup
+# the conf/masters file, this will be taken care of automatically. Yarn/Mesos
+# automatically configure the host name based on the hostname of the node where the
+# JobManager runs.
+
+jobmanager.rpc.address: {{groups.zookeeper[0]}},{{groups.zookeeper[1]}}
+
+# The RPC port where the JobManager is reachable.
+
+env.java.opts: "-XX:+UseG1GC -XX:NewRatio=2 -XX:MaxGCPauseMillis=300 
+-XX:InitiatingHeapOccupancyPercent=35 -Xloggc:{{ install_path }}/{{ flink_version }}/log/gc.log 
+-XX:+PrintGCDetails 
+-XX:-OmitStackTraceInFastThrow 
+-XX:+PrintGCTimeStamps 
+-XX:+PrintGCDateStamps 
+-XX:+UseGCLogFileRotation 
+-XX:NumberOfGCLogFiles=20 
+-XX:GCLogFileSize=20M"
+
+jobmanager.rpc.port: 6123
+
+cluster.evenly-spread-out-slots: true
+# The total process memory size for the JobManager.
+#
+# Note this accounts for all memory usage within the JobManager process, including JVM metaspace and other overhead.
+
+#jobmanager.memory.process.size: 1600m
+#taskmanager.heap.mb: 2g
+#jobmanager.heap.mb: 1g
+
+#taskmanager使用的堆外内存的大小
+taskmanager.memory.managed.size: {{ taskmanager_memory_managed_size }}
+
+#用于TaskManager之间（shuffle、广播等）及与外部组件的数据传输
+taskmanager.memory.network.min: {{ taskmanager_memory_network_min }}
+taskmanager.memory.network.max: {{ taskmanager_memory_network_max }}
+
+taskmanager.network.memory.floating-buffers-per-gate: 8
+taskmanager.network.memory.buffers-per-channel: 2
+
+#TaskManager进程占用的所有与Flink相关的内存
+taskmanager.memory.flink.size: {{ taskmanager_memory_flink_size }}
+
+#JobManager进程占用的所有与Flink相关的内存
+jobmanager.memory.flink.size: {{ jobmanager_memory_flink_size }}
+
+# The total process memory size for the TaskManager.
+#
+# Note this accounts for all memory usage within the TaskManager process, including JVM metaspace and other overhead.
+
+#taskmanager.memory.process.size: 1728m
+
+# To exclude JVM metaspace and overhead, please, use total Flink memory size instead of 'taskmanager.memory.process.size'.
+# It is not recommended to set both 'taskmanager.memory.process.size' and Flink memory.
+#
+# taskmanager.memory.flink.size: 1280m
+
+# The number of task slots that each TaskManager offers. Each slot runs one parallel pipeline.
+
+taskmanager.numberOfTaskSlots: 48
+
+# The parallelism used for programs that did not specify and other parallelism.
+
+parallelism.default: 1
+
+# The default file system scheme and authority.
+# 
+# By default file paths without scheme are interpreted relative to the local
+# root file system 'file:///'. Use this to override the default and interpret
+# relative paths relative to a different file system,
+# for example 'hdfs://mynamenode:12345'
+#
+# fs.default-scheme
+
+#==============================================================================
+# High Availability
+#==============================================================================
+
+# The high-availability mode. Possible options are 'NONE' or 'zookeeper'.
+#
+# high-availability: zookeeper
+
+# The path where metadata for master recovery is persisted. While ZooKeeper stores
+# the small ground truth for checkpoint and leader election, this location stores
+# the larger objects, like persisted dataflow graphs.
+# 
+# Must be a durable file system that is accessible from all nodes
+# (like HDFS, S3, Ceph, nfs, ...) 
+#
+# high-availability.storageDir: hdfs:///flink/ha/
+
+# The list of ZooKeeper quorum peers that coordinate the high-availability
+# setup. This must be a list of the form:
+# "host1:clientPort,host2:clientPort,..." (default clientPort: 2181)
+#
+high-availability: zookeeper
+high-availability.zookeeper.quorum: {{ zookeeper_servers }}
+high-availability.zookeeper.path.root: /flink
+high-availability.zookeeper.client.connection-timeout: 150000
+high-availability.zookeeper.client.max-retry-attempts: 10
+high-availability.zookeeper.client.retry-wait: 10000
+high-availability.zookeeper.client.session-timeout: 240000
+
+high-availability.cluster-id: /flink_cluster
+# important: customize per cluster
+high-availability.storageDir: hdfs://{{ groups.hadoop[0] }}:9000/flink/recover
+#high-availability.storageDir: hdfs:///flink/recover
+heartbeat.timeout: 180000 
+heartbeat.interval: 20000
+akka.ask.timeout: 300 s
+
+# ACL options are based on https://zookeeper.apache.org/doc/r3.1.2/zookeeperProgrammers.html#sc_BuiltinACLSchemes
+# It can be either "creator" (ZOO_CREATE_ALL_ACL) or "open" (ZOO_OPEN_ACL_UNSAFE)
+# The default value is "open" and it can be changed to "creator" if ZK security is enabled
+#
+# high-availability.zookeeper.client.acl: open
+
+#==============================================================================
+# Fault tolerance and checkpointing
+#==============================================================================
+
+# The backend that will be used to store operator state checkpoints if
+# checkpointing is enabled.
+#
+# Supported backends are 'jobmanager', 'filesystem', 'rocksdb', or the
+# <class-name-of-factory>.
+#
+# state.backend: filesystem
+
+# Directory for checkpoints filesystem, when using any of the default bundled
+# state backends.
+#
+# state.checkpoints.dir: hdfs://namenode-host:port/flink-checkpoints
+
+# Default target directory for savepoints, optional.
+#
+# state.savepoints.dir: hdfs://namenode-host:port/flink-savepoints
+
+# Flag to enable/disable incremental checkpoints for backends that
+# support incremental checkpoints (like the RocksDB state backend). 
+#
+# state.backend.incremental: false
+
+# The failover strategy, i.e., how the job computation recovers from task failures.
+# Only restart tasks that may have been affected by the task failure, which typically includes
+# downstream tasks and potentially upstream tasks if their produced data is no longer available for consumption.
+
+jobmanager.execution.failover-strategy: region
+
+rest.port: {{ flink_web_port }}
+
+restart-strategy: fixed-delay
+
+restart-strategy.fixed-delay.attempts: 100
+restart-strategy.fixed-delay.delay: 10 s
+
+jobmanager.web.upload.dir: {{ install_path }}/{{ flink_version }}/flink-web
+
+#==============================================================================
+# Rest & web frontend
+#==============================================================================
+
+# The port to which the REST client connects to. If rest.bind-port has
+# not been specified, then the server will bind to this port as well.
+#
+#rest.port: 8092
+
+# The address to which the REST client will connect to
+#
+#rest.address: 0.0.0.0
+
+# Port range for the REST and web server to bind to.
+#
+#rest.bind-port: 8080-8090
+
+# The address that the REST & web server binds to
+#
+#rest.bind-address: 0.0.0.0
+
+# Flag to specify whether job submission is enabled from the web-based
+# runtime monitor. Uncomment to disable.
+
+#web.submit.enable: false
+
+#==============================================================================
+# Advanced
+#==============================================================================
+
+# Override the directories for temporary files. If not specified, the
+# system-specific Java temporary directory (java.io.tmpdir property) is taken.
+#
+# For framework setups on Yarn or Mesos, Flink will automatically pick up the
+# containers' temp directories without any need for configuration.
+#
+# Add a delimited list for multiple directories, using the system directory
+# delimiter (colon ':' on unix) or a comma, e.g.:
+#     /data1/tmp:/data2/tmp:/data3/tmp
+#
+# Note: Each directory entry is read from and written to by a different I/O
+# thread. You can include the same directory multiple times in order to create
+# multiple I/O threads against that directory. This is for example relevant for
+# high-throughput RAIDs.
+#
+# io.tmp.dirs: /tmp
+
+# The classloading resolve order. Possible values are 'child-first' (Flink's default)
+# and 'parent-first' (Java's default).
+#
+# Child first classloading allows users to use different dependency/library
+# versions in their application than those in the classpath. Switching back
+# to 'parent-first' may help with debugging dependency issues.
+#
+# classloader.resolve-order: child-first
+
+# The amount of memory going to the network stack. These numbers usually need 
+# no tuning. Adjusting them may be necessary in case of an "Insufficient number
+# of network buffers" error. The default min is 64MB, the default max is 1GB.
+# 
+# taskmanager.memory.network.fraction: 0.1
+# taskmanager.memory.network.min: 64mb
+# taskmanager.memory.network.max: 1gb
+
+#==============================================================================
+# Flink Cluster Security Configuration
+#==============================================================================
+
+# Kerberos authentication for various components - Hadoop, ZooKeeper, and connectors -
+# may be enabled in four steps:
+# 1. configure the local krb5.conf file
+# 2. provide Kerberos credentials (either a keytab or a ticket cache w/ kinit)
+# 3. make the credentials available to various JAAS login contexts
+# 4. configure the connector to use JAAS/SASL
+
+# The below configure how Kerberos credentials are provided. A keytab will be used instead of
+# a ticket cache if the keytab path and principal are set.
+
+# security.kerberos.login.use-ticket-cache: true
+# security.kerberos.login.keytab: /path/to/kerberos/keytab
+# security.kerberos.login.principal: flink-user
+
+# The configuration below defines which JAAS login contexts
+
+# security.kerberos.login.contexts: Client,KafkaClient
+
+#==============================================================================
+# ZK Security Configuration
+#==============================================================================
+
+# Below configurations are applicable if ZK ensemble is configured for security
+
+# Override below configuration to provide custom ZK service name if configured
+# zookeeper.sasl.service-name: zookeeper
+
+# The configuration below must match one of the values set in "security.kerberos.login.contexts"
+# zookeeper.sasl.login-context-name: Client
+
+#==============================================================================
+# HistoryServer
+#==============================================================================
+
+# The HistoryServer is started and stopped via bin/historyserver.sh (start|stop)
+
+# Directory to upload completed jobs to. Add this directory to the list of
+# monitored directories of the HistoryServer as well (see below).
+#jobmanager.archive.fs.dir: hdfs:///completed-jobs/
+
+# The address under which the web-based HistoryServer listens.
+#historyserver.web.address: 0.0.0.0
+
+# The port under which the web-based HistoryServer listens.
+#historyserver.web.port: 8082
+
+# Comma separated list of directories to monitor for completed jobs.
+#historyserver.archive.fs.dir: hdfs:///completed-jobs/
+#historyserver.archive.fs.dir: /home/bigdata/flink-1.13.1/completed-jobs/
+
+# Interval in milliseconds for refreshing the monitored directories.
+#historyserver.archive.fs.refresh-interval: 10000
+
+
diff --git a/parcels/roles/components/flink/templates/keepflinkalive.j2 b/parcels/roles/components/flink/templates/keepflinkalive.j2
new file mode 100755
index 0000000..c239bab
--- /dev/null
+++ b/parcels/roles/components/flink/templates/keepflinkalive.j2
@@ -0,0 +1,42 @@
+#!/bin/bash
+# 
+# netconsole    This loads the netconsole module with the configured parameters.
+#
+# chkconfig:123456 30 70
+# description: keepkafkaalive
+source /etc/profile
+PRO_NAME=keepflinkalive
+
+case $1 in
+start)
+keepnum=`ps -ef | grep dae-flink.sh | grep -v grep | wc -l`
+
+if [ $keepnum -eq "0" ];then
+nohup {{ install_path }}/{{ flink_version }}/bin/dae-flink.sh > /dev/null 2>&1 &
+fi
+;;
+
+stop)
+keeppid=`ps -ef | grep dae-flink.sh | grep -v grep | awk '{print $2}'`
+if [ $keeppid ];then
+echo "守护进程PID：$keeppid"
+kill -9 $keeppid
+sleep 1
+{{ install_path }}/{{ flink_version }}/bin/stop-cluster.sh
+fi
+;;
+
+status)
+num=`jps | grep -w flink | grep -v grep |wc -l`
+if [ "$num" -eq "1" ];then
+echo "flink进程已启动"
+else
+echo "flink进程未启动"
+fi
+;;
+
+* )
+echo "use $0 [start|stop|status]"
+;;
+esac
+
diff --git a/parcels/roles/components/flink/templates/masters.j2 b/parcels/roles/components/flink/templates/masters.j2
new file mode 100644
index 0000000..e69de29
diff --git a/parcels/roles/components/flink/templates/set_flink_env.sh.j2 b/parcels/roles/components/flink/templates/set_flink_env.sh.j2
new file mode 100755
index 0000000..336fd1b
--- /dev/null
+++ b/parcels/roles/components/flink/templates/set_flink_env.sh.j2
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+num=`cat /etc/profile | grep flink | wc -l`
+
+if [ $num -eq "0" ];then
+	echo -e "\n#flink" >> /etc/profile
+	echo -e "export FLINK_HOME={{ install_path }}/{{ flink_version }}" >> /etc/profile
+	echo -e "export PATH=\$FLINK_HOME/bin:\$PATH" >> /etc/profile
+	source /etc/profile
+fi
+
+keeppath='/etc/init.d/keepflinkalive'
+if [ -x $keeppath ];then
+  chkconfig --add keepflinkalive
+  chkconfig keepflinkalive
+fi
+
diff --git a/parcels/roles/components/flink/templates/unload_flink.sh.j2 b/parcels/roles/components/flink/templates/unload_flink.sh.j2
new file mode 100755
index 0000000..78ddbf2
--- /dev/null
+++ b/parcels/roles/components/flink/templates/unload_flink.sh.j2
@@ -0,0 +1,25 @@
+#!/bin/bash
+source /etc/profile
+
+function killService(){
+keeppath='/etc/init.d/keepflinkalive'
+if [ -x $keeppath ];then
+service keepflinkalive stop
+chkconfig keepkafalive off
+systemctl daemon-reload
+rm -rf /etc/init.d/keepflinkalive
+fi
+}
+
+function killPid(){
+livenum=`jps -l | egrep -w "flink" | grep -v grep |wc -l`
+if [ $livenum -ne 0 ];then
+  ps aux | grep flink | grep -ivE "grep|unload_flink|ansible"  | awk '{print $2}' | xargs kill -9
+fi
+}
+
+killService
+sleep 5
+killPid
+rm -rf {{ install_path }}/{{ flink_version }}
+sleep 5
diff --git a/parcels/roles/components/flink/templates/workers.j2 b/parcels/roles/components/flink/templates/workers.j2
new file mode 100644
index 0000000..e69de29
diff --git a/parcels/roles/components/flink/vars/main.yml b/parcels/roles/components/flink/vars/main.yml
new file mode 100644
index 0000000..e34b03c
--- /dev/null
+++ b/parcels/roles/components/flink/vars/main.yml
@@ -0,0 +1,5 @@
+#flink版本
+flink_version: flink-1.13.1
+
+#web监听端口
+flink_web_port: 8080
diff --git a/parcels/roles/components/hadoop/tasks/install_hadoop.yml b/parcels/roles/components/hadoop/tasks/install_hadoop.yml
index 0f74b80..46c9f55 100644
--- a/parcels/roles/components/hadoop/tasks/install_hadoop.yml
+++ b/parcels/roles/components/hadoop/tasks/install_hadoop.yml
@@ -34,7 +34,7 @@
         force: true
         mode: 0755
       when: check_out.stdout >= '1'
-    - name: unload kafka
+    - name: unload hadoop
       shell: cd {{ install_path }} && sh unload_hadoop.sh
       when: check_out.stdout >= '1'
     - name: Ansible delete {{ install_path }}/unload_hadoop.sh
diff --git a/parcels/roles/components/mariadb/install-mariadb-cluster/tasks/install-mariadb.yml b/parcels/roles/components/mariadb/install-mariadb-cluster/tasks/install-mariadb.yml
index a93a732..73d5687 100644
--- a/parcels/roles/components/mariadb/install-mariadb-cluster/tasks/install-mariadb.yml
+++ b/parcels/roles/components/mariadb/install-mariadb-cluster/tasks/install-mariadb.yml
@@ -1,3 +1,8 @@
+- name: create {{ install_path }}
+  file:
+    state: directory
+    path: '{{ install_path }}'
+
 - block:
     - name: Check if the Mariadb service already exists
       shell: rpm -qa | grep MariaDB | wc -l
diff --git a/parcels/roles/init/clickhouse/templates/create_ck_table.sql b/parcels/roles/init/clickhouse/templates/create_ck_table.sql
index b6259fb..2bba43c 100644
--- a/parcels/roles/init/clickhouse/templates/create_ck_table.sql
+++ b/parcels/roles/init/clickhouse/templates/create_ck_table.sql
@@ -1,8 +1,57 @@
-create database IF NOT EXISTS tsg_galaxy_v3 on cluster ck_cluster;
-create database IF NOT EXISTS tsg_galaxy_v3 on cluster ck_query;
+create database IF NOT EXISTS tsg_galaxy_v3 ON CLUSTER ck_cluster;
+create database IF NOT EXISTS tsg_galaxy_v3 ON CLUSTER ck_query;
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.dos_event_log_local ON CLUSTER ck_cluster(
+log_id UInt64,
+ start_time Int64,
+ end_time Int64,
+ attack_type String,
+ severity String,
+ conditions String,
+ destination_ip String,
+ destination_country String,
+ source_ip_list String,
+ source_country_list String,
+ session_rate Int64,
+ packet_rate Int64,
+ bit_rate Int64
+) ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(start_time)) ORDER BY (log_id, start_time, destination_ip) SETTINGS index_granularity = 8192;
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.dos_event_log ON CLUSTER ck_cluster(
+ log_id UInt64,
+ start_time Int64,
+ end_time Int64,
+ attack_type String,
+ severity String,
+ conditions String,
+ destination_ip String,
+ destination_country String,
+ source_ip_list String,
+ source_country_list String,
+ session_rate Int64,
+ packet_rate Int64,
+ bit_rate Int64
+) ENGINE = Distributed('ck_cluster', 'tsg_galaxy_v3', 'dos_event_log_local', rand());
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.dos_event_log ON CLUSTER ck_query(
+ log_id UInt64,
+ start_time Int64,
+ end_time Int64,
+ attack_type String,
+ severity String,
+ conditions String,
+ destination_ip String,
+ destination_country String,
+ source_ip_list String,
+ source_country_list String,
+ session_rate Int64,
+ packet_rate Int64,
+ bit_rate Int64
+) ENGINE = Distributed('ck_cluster', 'tsg_galaxy_v3', 'dos_event_log_local', rand());
+
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log_local ON CLUSTER ck_cluster(
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -16,7 +65,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log_local on cluster ck_clu
 	common_entrance_id Int64,
 	common_device_id String,
 	common_egress_link_id Nullable(Int64),
-        common_ingress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
 	common_isp String,
 	common_data_center String,
 	common_sled_ip String,
@@ -70,6 +119,8 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log_local on cluster ck_clu
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -96,722 +147,7 @@ ORDER BY (common_log_id,common_data_center,common_recv_time);
 
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log on cluster ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_egress_link_id Nullable(Int64),
-	common_ingress_link_id Nullable(Int64),
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_userdefine_app_name String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	gtp_version String,
-	gtp_apn String,
-	gtp_imei String,
-	gtp_imsi String,
-	gtp_phone_number String,
-	gtp_uplink_teid Int64,
-	gtp_downlink_teid Int64,
-	gtp_msg_type String,
-	gtp_end_user_ipv4 String,
-	gtp_end_user_ipv6 String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,gtpc_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log on cluster ck_query(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_egress_link_id Nullable(Int64),
-	common_ingress_link_id Nullable(Int64),
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_userdefine_app_name String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	gtp_version String,
-	gtp_apn String,
-	gtp_imei String,
-	gtp_imsi String,
-	gtp_phone_number String,
-	gtp_uplink_teid Int64,
-	gtp_downlink_teid Int64,
-	gtp_msg_type String,
-	gtp_end_user_ipv4 String,
-	gtp_end_user_ipv6 String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,gtpc_record_log_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log_local on cluster ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_egress_link_id Nullable(Int64),
-	common_ingress_link_id Nullable(Int64),
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_userdefine_app_name String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_latency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_log_id,common_data_center,common_recv_time);
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log_local on cluster ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_egress_link_id Nullable(Int64),
-	common_ingress_link_id Nullable(Int64),
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_userdefine_app_name String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_latency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_stream_trace_id,common_data_center,common_recv_time);
-
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log on cluster ck_query(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_egress_link_id Nullable(Int64),
-	common_ingress_link_id Nullable(Int64),
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_userdefine_app_name String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_latency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,live_session_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log ON CLUSTER ck_cluster(
 		common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -879,6 +215,8 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log on cluster ck_c
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -889,6 +227,732 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log on cluster ck_c
 	common_stream_error String,
 	common_link_info_c2s String,
 	common_link_info_s2c String,
+	gtp_version String,
+	gtp_apn String,
+	gtp_imei String,
+	gtp_imsi String,
+	gtp_phone_number String,
+	gtp_uplink_teid Int64,
+	gtp_downlink_teid Int64,
+	gtp_msg_type String,
+	gtp_end_user_ipv4 String,
+	gtp_end_user_ipv6 String
+) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,gtpc_record_log_local,rand());
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log ON CLUSTER ck_query(
+	common_recv_time Int64,
+	common_log_id UInt64,
+	common_stream_trace_id UInt64,
+	common_direction Nullable(Int64),
+	common_stream_dir Int64,
+	common_start_time Int64,
+	common_end_time Int64,
+	common_con_duration_ms Int64,
+	common_establish_latency_ms Int64,
+	common_processing_time Int64,
+	common_entrance_id Int64,
+	common_device_id String,
+	common_egress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
+	common_isp String,
+	common_data_center String,
+	common_sled_ip String,
+	common_action Int64,
+	common_sub_action String,
+	common_policy_id Int64,
+	common_user_tags String,
+	common_user_region String,
+	common_client_ip String,
+	common_internal_ip String,
+	common_client_port Int64,
+	common_client_location String,
+	common_client_asn String,
+	common_subscriber_id String,
+	common_imei String,
+	common_imsi String,
+	common_phone_number String,
+	common_server_ip String,
+	common_external_ip String,
+	common_server_port Int64,
+	common_server_location String,
+	common_server_asn String,
+	common_app_id String,
+	common_userdefine_app_name String,
+	common_app_label String,
+	common_app_surrogate_id String,
+	common_l7_protocol String,
+	common_protocol_label String,
+	common_service_category Array(Int64),
+	common_service Int64,
+	common_l4_protocol String,
+	common_sessions Int64,
+	common_c2s_pkt_num Int64,
+	common_s2c_pkt_num Int64,
+	common_c2s_pkt_diff Int64,
+	common_s2c_pkt_diff Int64,
+	common_c2s_byte_num Int64,
+	common_s2c_byte_num Int64,
+	common_c2s_byte_diff Int64,
+	common_s2c_byte_diff Int64,
+	common_c2s_ipfrag_num Int64,
+	common_s2c_ipfrag_num Int64,
+	common_c2s_tcp_lostlen Int64,
+	common_s2c_tcp_lostlen Int64,
+	common_c2s_tcp_unorder_num Int64,
+	common_s2c_tcp_unorder_num Int64,
+	common_c2s_pkt_retrans Int64,
+	common_s2c_pkt_retrans Int64,
+	common_c2s_byte_retrans Int64,
+	common_s2c_byte_retrans Int64,
+	common_first_ttl Int64,
+	common_tcp_client_isn Int64,
+	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
+	common_address_type Int64,
+	common_schema_type String,
+	common_device_tag String,
+	common_encapsulation Int64,
+	common_tunnels String,
+	common_address_list String,
+	common_has_dup_traffic Int64,
+	common_stream_error String,
+	common_link_info_c2s String,
+	common_link_info_s2c String,
+	gtp_version String,
+	gtp_apn String,
+	gtp_imei String,
+	gtp_imsi String,
+	gtp_phone_number String,
+	gtp_uplink_teid Int64,
+	gtp_downlink_teid Int64,
+	gtp_msg_type String,
+	gtp_end_user_ipv4 String,
+	gtp_end_user_ipv6 String
+) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,gtpc_record_log_local,rand());
+
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log_local ON CLUSTER ck_cluster(
+	common_recv_time Int64,
+	common_log_id UInt64,
+	common_stream_trace_id UInt64,
+	common_direction Nullable(Int64),
+	common_stream_dir Int64,
+	common_start_time Int64,
+	common_end_time Int64,
+	common_con_duration_ms Int64,
+	common_establish_latency_ms Int64,
+	common_processing_time Int64,
+	common_entrance_id Int64,
+	common_device_id String,
+	common_egress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
+	common_isp String,
+	common_data_center String,
+	common_sled_ip String,
+	common_action Int64,
+	common_sub_action String,
+	common_policy_id Int64,
+	common_user_tags String,
+	common_user_region String,
+	common_client_ip String,
+	common_internal_ip String,
+	common_client_port Int64,
+	common_client_location LowCardinality(String),
+	common_client_asn String,
+	common_subscriber_id String,
+	common_imei String,
+	common_imsi String,
+	common_phone_number String,
+	common_server_ip String,
+	common_external_ip String,
+	common_server_port Int64,
+	common_server_location LowCardinality(String),
+	common_server_asn String,
+	common_app_id String,
+	common_userdefine_app_name String,
+	common_app_label LowCardinality(String),
+	common_app_surrogate_id String,
+	common_l7_protocol LowCardinality(String),
+	common_protocol_label String,
+	common_service_category Array(Int64),
+	common_service Int64,
+	common_l4_protocol LowCardinality(String),
+	common_sessions Int64,
+	common_c2s_pkt_num Int64,
+	common_s2c_pkt_num Int64,
+	common_c2s_pkt_diff Int64,
+	common_s2c_pkt_diff Int64,
+	common_c2s_byte_num Int64,
+	common_s2c_byte_num Int64,
+	common_c2s_byte_diff Int64,
+	common_s2c_byte_diff Int64,
+	common_c2s_ipfrag_num Int64,
+	common_s2c_ipfrag_num Int64,
+	common_c2s_tcp_lostlen Int64,
+	common_s2c_tcp_lostlen Int64,
+	common_c2s_tcp_unorder_num Int64,
+	common_s2c_tcp_unorder_num Int64,
+	common_c2s_pkt_retrans Int64,
+	common_s2c_pkt_retrans Int64,
+	common_c2s_byte_retrans Int64,
+	common_s2c_byte_retrans Int64,
+	common_first_ttl Int64,
+	common_tcp_client_isn Int64,
+	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
+	common_address_type Int64,
+	common_schema_type LowCardinality(String),
+	common_device_tag String,
+	common_encapsulation Int64,
+	common_tunnels String,
+	common_address_list String,
+	common_has_dup_traffic Int64,
+	common_stream_error String,
+	common_link_info_c2s String,
+	common_link_info_s2c String,
+	http_url String,
+	http_host String,
+	http_domain String,
+	http_request_line String,
+	http_response_line String,
+	http_request_header String,
+	http_response_header String,
+	http_request_content String,
+	http_response_content String,
+	http_request_body String,
+	http_response_body String,
+	http_request_body_key String,
+	http_response_body_key String,
+	http_proxy_flag Int64,
+	http_sequence Int64,
+	http_snapshot String,
+	http_cookie String,
+	http_referer String,
+	http_user_agent String,
+	http_content_length String,
+	http_content_type String,
+	http_set_cookie String,
+	http_version String,
+	http_response_latency_ms Int64,
+	http_session_duration_ms Int64,
+	http_action_file_size Int64,
+	mail_protocol_type String,
+	mail_account String,
+	mail_to_cmd String,
+	mail_from_cmd String,
+	mail_from String,
+	mail_to String,
+	mail_cc String,
+	mail_bcc String,
+	mail_subject String,
+	mail_subject_charset String,
+	mail_content String,
+	mail_content_charset String,
+	mail_attachment_name String,
+	mail_attachment_name_charset String,
+	mail_attachment_content String,
+	mail_eml_file String,
+	mail_snapshot String,
+	dns_message_id Int64,
+	dns_qr Nullable(Int64),
+	dns_opcode Nullable(Int64),
+	dns_aa Int64,
+	dns_tc Int64,
+	dns_rd Int64,
+	dns_ra Int64,
+	dns_rcode Int64,
+	dns_qdcount Int64,
+	dns_ancount Int64,
+	dns_nscount Int64,
+	dns_arcount Int64,
+	dns_qname String,
+	dns_qtype Int64,
+	dns_qclass Int64,
+	dns_cname String,
+	dns_sub Int64,
+	dns_rr String,
+	ssl_version String,
+	ssl_sni String,
+	ssl_san String,
+	ssl_cn String,
+	ssl_pinningst Nullable(Int64),
+	ssl_intercept_state Nullable(Int64),
+	ssl_server_side_latency Int64,
+	ssl_client_side_latency Int64,
+	ssl_server_side_version String,
+	ssl_client_side_version String,
+	ssl_cert_verify Nullable(Int64),
+	ssl_error String,
+	ssl_con_latency_ms Int64,
+	ssl_ja3_fingerprint String,
+	ssl_ja3_hash String,
+	ssl_cert_issuer String,
+	ssl_cert_subject String,
+	quic_version String,
+	quic_sni String,
+	quic_user_agent String,
+	ftp_account String,
+	ftp_url String,
+	ftp_content String,
+	ftp_link_type String,
+	bgp_type Int64,
+	bgp_as_num String,
+	bgp_route String,
+	voip_calling_account String,
+	voip_called_account String,
+	voip_calling_number String,
+	voip_called_number String,
+	streaming_media_url String,
+	streaming_media_protocol String,
+	app_extra_info String,
+	sip_call_id String,
+	sip_originator_description String,
+	sip_responder_description String,
+	sip_user_agent String,
+	sip_server String,
+	sip_originator_sdp_connect_ip String,
+	sip_originator_sdp_media_port Int64,
+	sip_originator_sdp_media_type String,
+	sip_originator_sdp_content String,
+	sip_responder_sdp_connect_ip String,
+	sip_responder_sdp_media_port Int64,
+	sip_responder_sdp_media_type String,
+	sip_responder_sdp_content String,
+	sip_duration Int64,
+	sip_bye String,
+	rtp_payload_type_c2s Nullable(Int64),
+	rtp_payload_type_s2c Nullable(Int64),
+	rtp_pcap_path String,
+	rtp_originator_dir Int64
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
+ORDER BY (common_log_id,common_data_center,common_recv_time);
+
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log_local ON CLUSTER ck_cluster(
+	common_recv_time Int64,
+	common_log_id UInt64,
+	common_stream_trace_id UInt64,
+	common_direction Nullable(Int64),
+	common_stream_dir Int64,
+	common_start_time Int64,
+	common_end_time Int64,
+	common_con_duration_ms Int64,
+	common_establish_latency_ms Int64,
+	common_processing_time Int64,
+	common_entrance_id Int64,
+	common_device_id String,
+	common_egress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
+	common_isp String,
+	common_data_center String,
+	common_sled_ip String,
+	common_action Int64,
+	common_sub_action String,
+	common_policy_id Int64,
+	common_user_tags String,
+	common_user_region String,
+	common_client_ip String,
+	common_internal_ip String,
+	common_client_port Int64,
+	common_client_location LowCardinality(String),
+	common_client_asn String,
+	common_subscriber_id String,
+	common_imei String,
+	common_imsi String,
+	common_phone_number String,
+	common_server_ip String,
+	common_external_ip String,
+	common_server_port Int64,
+	common_server_location LowCardinality(String),
+	common_server_asn String,
+	common_app_id String,
+	common_userdefine_app_name String,
+	common_app_label LowCardinality(String),
+	common_app_surrogate_id String,
+	common_l7_protocol LowCardinality(String),
+	common_protocol_label String,
+	common_service_category Array(Int64),
+	common_service Int64,
+	common_l4_protocol LowCardinality(String),
+	common_sessions Int64,
+	common_c2s_pkt_num Int64,
+	common_s2c_pkt_num Int64,
+	common_c2s_pkt_diff Int64,
+	common_s2c_pkt_diff Int64,
+	common_c2s_byte_num Int64,
+	common_s2c_byte_num Int64,
+	common_c2s_byte_diff Int64,
+	common_s2c_byte_diff Int64,
+	common_c2s_ipfrag_num Int64,
+	common_s2c_ipfrag_num Int64,
+	common_c2s_tcp_lostlen Int64,
+	common_s2c_tcp_lostlen Int64,
+	common_c2s_tcp_unorder_num Int64,
+	common_s2c_tcp_unorder_num Int64,
+	common_c2s_pkt_retrans Int64,
+	common_s2c_pkt_retrans Int64,
+	common_c2s_byte_retrans Int64,
+	common_s2c_byte_retrans Int64,
+	common_first_ttl Int64,
+	common_tcp_client_isn Int64,
+	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
+	common_address_type Int64,
+	common_schema_type LowCardinality(String),
+	common_device_tag String,
+	common_encapsulation Int64,
+	common_tunnels String,
+	common_address_list String,
+	common_has_dup_traffic Int64,
+	common_stream_error String,
+	common_link_info_c2s String,
+	common_link_info_s2c String,
+	http_url String,
+	http_host String,
+	http_domain String,
+	http_request_line String,
+	http_response_line String,
+	http_request_header String,
+	http_response_header String,
+	http_request_content String,
+	http_response_content String,
+	http_request_body String,
+	http_response_body String,
+	http_request_body_key String,
+	http_response_body_key String,
+	http_proxy_flag Int64,
+	http_sequence Int64,
+	http_snapshot String,
+	http_cookie String,
+	http_referer String,
+	http_user_agent String,
+	http_content_length String,
+	http_content_type String,
+	http_set_cookie String,
+	http_version String,
+	http_response_latency_ms Int64,
+	http_session_duration_ms Int64,
+	http_action_file_size Int64,
+	dns_message_id Int64,
+	dns_qr Nullable(Int64),
+	dns_opcode Nullable(Int64),
+	dns_aa Int64,
+	dns_tc Int64,
+	dns_rd Int64,
+	dns_ra Int64,
+	dns_rcode Int64,
+	dns_qdcount Int64,
+	dns_ancount Int64,
+	dns_nscount Int64,
+	dns_arcount Int64,
+	dns_qname String,
+	dns_qtype Int64,
+	dns_qclass Int64,
+	dns_cname String,
+	dns_sub Int64,
+	dns_rr String,
+	sip_call_id String,
+	sip_originator_description String,
+	sip_responder_description String,
+	sip_user_agent String,
+	sip_server String,
+	sip_originator_sdp_connect_ip String,
+	sip_originator_sdp_media_port Int64,
+	sip_originator_sdp_media_type String,
+	sip_originator_sdp_content String,
+	sip_responder_sdp_connect_ip String,
+	sip_responder_sdp_media_port Int64,
+	sip_responder_sdp_media_type String,
+	sip_responder_sdp_content String,
+	sip_duration Int64,
+	sip_bye String
+
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
+ORDER BY (common_stream_trace_id,common_data_center,common_recv_time);
+
+
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log ON CLUSTER ck_query(
+	common_recv_time Int64,
+	common_log_id UInt64,
+	common_stream_trace_id UInt64,
+	common_direction Nullable(Int64),
+	common_stream_dir Int64,
+	common_start_time Int64,
+	common_end_time Int64,
+	common_con_duration_ms Int64,
+	common_establish_latency_ms Int64,
+	common_processing_time Int64,
+	common_entrance_id Int64,
+	common_device_id String,
+	common_egress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
+	common_isp String,
+	common_data_center String,
+	common_sled_ip String,
+	common_action Int64,
+	common_sub_action String,
+	common_policy_id Int64,
+	common_user_tags String,
+	common_user_region String,
+	common_client_ip String,
+	common_internal_ip String,
+	common_client_port Int64,
+	common_client_location LowCardinality(String),
+	common_client_asn String,
+	common_subscriber_id String,
+	common_imei String,
+	common_imsi String,
+	common_phone_number String,
+	common_server_ip String,
+	common_external_ip String,
+	common_server_port Int64,
+	common_server_location LowCardinality(String),
+	common_server_asn String,
+	common_app_id String,
+	common_userdefine_app_name String,
+	common_app_label LowCardinality(String),
+	common_app_surrogate_id String,
+	common_l7_protocol LowCardinality(String),
+	common_protocol_label String,
+	common_service_category Array(Int64),
+	common_service Int64,
+	common_l4_protocol LowCardinality(String),
+	common_sessions Int64,
+	common_c2s_pkt_num Int64,
+	common_s2c_pkt_num Int64,
+	common_c2s_pkt_diff Int64,
+	common_s2c_pkt_diff Int64,
+	common_c2s_byte_num Int64,
+	common_s2c_byte_num Int64,
+	common_c2s_byte_diff Int64,
+	common_s2c_byte_diff Int64,
+	common_c2s_ipfrag_num Int64,
+	common_s2c_ipfrag_num Int64,
+	common_c2s_tcp_lostlen Int64,
+	common_s2c_tcp_lostlen Int64,
+	common_c2s_tcp_unorder_num Int64,
+	common_s2c_tcp_unorder_num Int64,
+	common_c2s_pkt_retrans Int64,
+	common_s2c_pkt_retrans Int64,
+	common_c2s_byte_retrans Int64,
+	common_s2c_byte_retrans Int64,
+	common_first_ttl Int64,
+	common_tcp_client_isn Int64,
+	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
+	common_address_type Int64,
+	common_schema_type LowCardinality(String),
+	common_device_tag String,
+	common_encapsulation Int64,
+	common_tunnels String,
+	common_address_list String,
+	common_has_dup_traffic Int64,
+	common_stream_error String,
+	common_link_info_c2s String,
+	common_link_info_s2c String,
+	http_url String,
+	http_host String,
+	http_domain String,
+	http_request_line String,
+	http_response_line String,
+	http_request_header String,
+	http_response_header String,
+	http_request_content String,
+	http_response_content String,
+	http_request_body String,
+	http_response_body String,
+	http_request_body_key String,
+	http_response_body_key String,
+	http_proxy_flag Int64,
+	http_sequence Int64,
+	http_snapshot String,
+	http_cookie String,
+	http_referer String,
+	http_user_agent String,
+	http_content_length String,
+	http_content_type String,
+	http_set_cookie String,
+	http_version String,
+	http_response_latency_ms Int64,
+	http_session_duration_ms Int64,
+	http_action_file_size Int64,
+	mail_protocol_type String,
+	mail_account String,
+	mail_to_cmd String,
+	mail_from_cmd String,
+	mail_from String,
+	mail_to String,
+	mail_cc String,
+	mail_bcc String,
+	mail_subject String,
+	mail_subject_charset String,
+	mail_content String,
+	mail_content_charset String,
+	mail_attachment_name String,
+	mail_attachment_name_charset String,
+	mail_attachment_content String,
+	mail_eml_file String,
+	mail_snapshot String,
+	dns_message_id Int64,
+	dns_qr Nullable(Int64),
+	dns_opcode Nullable(Int64),
+	dns_aa Int64,
+	dns_tc Int64,
+	dns_rd Int64,
+	dns_ra Int64,
+	dns_rcode Int64,
+	dns_qdcount Int64,
+	dns_ancount Int64,
+	dns_nscount Int64,
+	dns_arcount Int64,
+	dns_qname String,
+	dns_qtype Int64,
+	dns_qclass Int64,
+	dns_cname String,
+	dns_sub Int64,
+	dns_rr String,
+	ssl_version String,
+	ssl_sni String,
+	ssl_san String,
+	ssl_cn String,
+	ssl_pinningst Nullable(Int64),
+	ssl_intercept_state Nullable(Int64),
+	ssl_server_side_latency Int64,
+	ssl_client_side_latency Int64,
+	ssl_server_side_version String,
+	ssl_client_side_version String,
+	ssl_cert_verify Nullable(Int64),
+	ssl_error String,
+	ssl_con_latency_ms Int64,
+	ssl_ja3_fingerprint String,
+	ssl_ja3_hash String,
+	ssl_cert_issuer String,
+	ssl_cert_subject String,
+	quic_version String,
+	quic_sni String,
+	quic_user_agent String,
+	ftp_account String,
+	ftp_url String,
+	ftp_content String,
+	ftp_link_type String,
+	bgp_type Int64,
+	bgp_as_num String,
+	bgp_route String,
+	voip_calling_account String,
+	voip_called_account String,
+	voip_calling_number String,
+	voip_called_number String,
+	streaming_media_url String,
+	streaming_media_protocol String,
+	app_extra_info String,
+	sip_call_id String,
+	sip_originator_description String,
+	sip_responder_description String,
+	sip_user_agent String,
+	sip_server String,
+	sip_originator_sdp_connect_ip String,
+	sip_originator_sdp_media_port Int64,
+	sip_originator_sdp_media_type String,
+	sip_originator_sdp_content String,
+	sip_responder_sdp_connect_ip String,
+	sip_responder_sdp_media_port Int64,
+	sip_responder_sdp_media_type String,
+	sip_responder_sdp_content String,
+	sip_duration Int64,
+	sip_bye String,
+	rtp_payload_type_c2s Nullable(Int64),
+	rtp_payload_type_s2c Nullable(Int64),
+	rtp_pcap_path String,
+	rtp_originator_dir Int64
+) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,live_session_record_log_local,rand());
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log ON CLUSTER ck_cluster(
+	common_recv_time Int64,
+	common_log_id UInt64,
+	common_stream_trace_id UInt64,
+	common_direction Nullable(Int64),
+	common_stream_dir Int64,
+	common_start_time Int64,
+	common_end_time Int64,
+	common_con_duration_ms Int64,
+	common_establish_latency_ms Int64,
+	common_processing_time Int64,
+	common_entrance_id Int64,
+	common_device_id String,
+	common_egress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
+	common_isp String,
+	common_data_center String,
+	common_sled_ip String,
+	common_action Int64,
+	common_sub_action String,
+	common_policy_id Int64,
+	common_user_tags String,
+	common_user_region String,
+	common_client_ip String,
+	common_internal_ip String,
+	common_client_port Int64,
+	common_client_location LowCardinality(String),
+	common_client_asn String,
+	common_subscriber_id String,
+	common_imei String,
+	common_imsi String,
+	common_phone_number String,
+	common_server_ip String,
+	common_external_ip String,
+	common_server_port Int64,
+	common_server_location LowCardinality(String),
+	common_server_asn String,
+	common_app_id String,
+	common_userdefine_app_name String,
+	common_app_label LowCardinality(String),
+	common_app_surrogate_id String,
+	common_l7_protocol LowCardinality(String),
+	common_protocol_label String,
+	common_service_category Array(Int64),
+	common_service Int64,
+	common_l4_protocol LowCardinality(String),
+	common_sessions Int64,
+	common_c2s_pkt_num Int64,
+	common_s2c_pkt_num Int64,
+	common_c2s_pkt_diff Int64,
+	common_s2c_pkt_diff Int64,
+	common_c2s_byte_num Int64,
+	common_s2c_byte_num Int64,
+	common_c2s_byte_diff Int64,
+	common_s2c_byte_diff Int64,
+	common_c2s_ipfrag_num Int64,
+	common_s2c_ipfrag_num Int64,
+	common_c2s_tcp_lostlen Int64,
+	common_s2c_tcp_lostlen Int64,
+	common_c2s_tcp_unorder_num Int64,
+	common_s2c_tcp_unorder_num Int64,
+	common_c2s_pkt_retrans Int64,
+	common_s2c_pkt_retrans Int64,
+	common_c2s_byte_retrans Int64,
+	common_s2c_byte_retrans Int64,
+	common_first_ttl Int64,
+	common_tcp_client_isn Int64,
+	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
+	common_address_type Int64,
+	common_schema_type LowCardinality(String),
+	common_device_tag String,
+	common_encapsulation Int64,
+	common_tunnels String,
+	common_address_list String,
+	common_has_dup_traffic Int64,
+	common_stream_error String,
+	common_link_info_c2s String,
+	common_link_info_s2c String,
 	http_url String,
 	http_host String,
 	http_domain String,
@@ -1006,7 +1070,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log on cluster ck_c
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,live_session_record_log_local,rand());
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_query(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log ON CLUSTER ck_query(
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -1032,7 +1096,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_qu
 	common_client_ip String,
 	common_internal_ip String,
 	common_client_port Int64,
-	common_client_location String,
+	common_client_location LowCardinality(String),
 	common_client_asn String,
 	common_subscriber_id String,
 	common_imei String,
@@ -1041,17 +1105,17 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_qu
 	common_server_ip String,
 	common_external_ip String,
 	common_server_port Int64,
-	common_server_location String,
+	common_server_location LowCardinality(String),
 	common_server_asn String,
 	common_app_id String,
 	common_userdefine_app_name String,
-	common_app_label String,
+	common_app_label LowCardinality(String),
 	common_app_surrogate_id String,
-	common_l7_protocol String,
+	common_l7_protocol LowCardinality(String),
 	common_protocol_label String,
 	common_service_category Array(Int64),
 	common_service Int64,
-	common_l4_protocol String,
+	common_l4_protocol LowCardinality(String),
 	common_sessions Int64,
 	common_c2s_pkt_num Int64,
 	common_s2c_pkt_num Int64,
@@ -1074,8 +1138,10 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_qu
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
-	common_schema_type String,
+	common_schema_type LowCardinality(String),
 	common_device_tag String,
 	common_encapsulation Int64,
 	common_tunnels String,
@@ -1145,7 +1211,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_qu
 	sip_bye String
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,transaction_record_log_local,rand());
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log ON CLUSTER ck_cluster(
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -1171,7 +1237,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_cl
 	common_client_ip String,
 	common_internal_ip String,
 	common_client_port Int64,
-	common_client_location String,
+	common_client_location LowCardinality(String),
 	common_client_asn String,
 	common_subscriber_id String,
 	common_imei String,
@@ -1180,17 +1246,17 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_cl
 	common_server_ip String,
 	common_external_ip String,
 	common_server_port Int64,
-	common_server_location String,
+	common_server_location LowCardinality(String),
 	common_server_asn String,
 	common_app_id String,
 	common_userdefine_app_name String,
-	common_app_label String,
+	common_app_label LowCardinality(String),
 	common_app_surrogate_id String,
-	common_l7_protocol String,
+	common_l7_protocol LowCardinality(String),
 	common_protocol_label String,
 	common_service_category Array(Int64),
 	common_service Int64,
-	common_l4_protocol String,
+	common_l4_protocol LowCardinality(String),
 	common_sessions Int64,
 	common_c2s_pkt_num Int64,
 	common_s2c_pkt_num Int64,
@@ -1213,8 +1279,10 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_cl
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
-	common_schema_type String,
+	common_schema_type LowCardinality(String),
 	common_device_tag String,
 	common_encapsulation Int64,
 	common_tunnels String,
@@ -1287,7 +1355,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log on cluster ck_cl
 
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log_local ON CLUSTER ck_cluster(
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -1355,6 +1423,8 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log_local on cluster ck_clu
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -1386,105 +1456,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log_local on cluster ck_clu
 	rtp_originator_dir Int64
 )ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_data_center,common_recv_time);
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log on cluster ck_query(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_egress_link_id Nullable(Int64),	common_ingress_link_id Nullable(Int64),
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_userdefine_app_name String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,voip_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log ON CLUSTER ck_query(
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -1552,6 +1524,8 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log on cluster ck_cluster(
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -1583,7 +1557,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log on cluster ck_cluster(
 	rtp_originator_dir Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,voip_record_log_local,rand());
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log ON CLUSTER ck_cluster(
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -1651,6 +1625,109 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log_local on cluster
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
+	common_address_type Int64,
+	common_schema_type String,
+	common_device_tag String,
+	common_encapsulation Int64,
+	common_tunnels String,
+	common_address_list String,
+	common_has_dup_traffic Int64,
+	common_stream_error String,
+	common_link_info_c2s String,
+	common_link_info_s2c String,
+	sip_call_id String,
+	sip_originator_description String,
+	sip_responder_description String,
+	sip_user_agent String,
+	sip_server String,
+	sip_originator_sdp_connect_ip String,
+	sip_originator_sdp_media_port Int64,
+	sip_originator_sdp_media_type String,
+	sip_originator_sdp_content String,
+	sip_responder_sdp_connect_ip String,
+	sip_responder_sdp_media_port Int64,
+	sip_responder_sdp_media_type String,
+	sip_responder_sdp_content String,
+	sip_duration Int64,
+	sip_bye String,
+	rtp_payload_type_c2s Nullable(Int64),
+	rtp_payload_type_s2c Nullable(Int64),
+	rtp_pcap_path String,
+	rtp_originator_dir Int64
+) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,voip_record_log_local,rand());
+
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log_local ON CLUSTER ck_cluster(
+	common_recv_time Int64,
+	common_log_id UInt64,
+	common_stream_trace_id UInt64,
+	common_direction Nullable(Int64),
+	common_stream_dir Int64,
+	common_start_time Int64,
+	common_end_time Int64,
+	common_con_duration_ms Int64,
+	common_establish_latency_ms Int64,
+	common_processing_time Int64,
+	common_entrance_id Int64,
+	common_device_id String,
+	common_egress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
+	common_isp String,
+	common_data_center String,
+	common_sled_ip String,
+	common_action Int64,
+	common_sub_action String,
+	common_policy_id Int64,
+	common_user_tags String,
+	common_user_region String,
+	common_client_ip String,
+	common_internal_ip String,
+	common_client_port Int64,
+	common_client_location String,
+	common_client_asn String,
+	common_subscriber_id String,
+	common_imei String,
+	common_imsi String,
+	common_phone_number String,
+	common_server_ip String,
+	common_external_ip String,
+	common_server_port Int64,
+	common_server_location String,
+	common_server_asn String,
+	common_app_id String,
+	common_userdefine_app_name String,
+	common_app_label String,
+	common_app_surrogate_id String,
+	common_l7_protocol String,
+	common_protocol_label String,
+	common_service_category Array(Int64),
+	common_service Int64,
+	common_l4_protocol String,
+	common_sessions Int64,
+	common_c2s_pkt_num Int64,
+	common_s2c_pkt_num Int64,
+	common_c2s_pkt_diff Int64,
+	common_s2c_pkt_diff Int64,
+	common_c2s_byte_num Int64,
+	common_s2c_byte_num Int64,
+	common_c2s_byte_diff Int64,
+	common_s2c_byte_diff Int64,
+	common_c2s_ipfrag_num Int64,
+	common_s2c_ipfrag_num Int64,
+	common_c2s_tcp_lostlen Int64,
+	common_s2c_tcp_lostlen Int64,
+	common_c2s_tcp_unorder_num Int64,
+	common_s2c_tcp_unorder_num Int64,
+	common_c2s_pkt_retrans Int64,
+	common_s2c_pkt_retrans Int64,
+	common_c2s_byte_retrans Int64,
+	common_s2c_byte_retrans Int64,
+	common_first_ttl Int64,
+	common_tcp_client_isn Int64,
+	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -1671,7 +1748,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log_local on cluster
 ENGINE =MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log_local ON CLUSTER ck_cluster(
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -1739,6 +1816,8 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log_local on cluster ck_
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -1867,7 +1946,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log_local on cluster ck_
 )
 ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log_local ON CLUSTER ck_cluster(
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -1935,6 +2014,8 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log_local on cluster ck_clu
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -2004,8 +2085,8 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log_local on cluster ck_clu
 ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_local on cluster ck_cluster(
-		common_recv_time Int64,
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_local ON CLUSTER ck_cluster(
+	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
 	common_direction Nullable(Int64),
@@ -2030,7 +2111,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_local on cluster
 	common_client_ip String,
 	common_internal_ip String,
 	common_client_port Int64,
-	common_client_location String,
+	common_client_location LowCardinality(String),
 	common_client_asn String,
 	common_subscriber_id String,
 	common_imei String,
@@ -2039,17 +2120,17 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_local on cluster
 	common_server_ip String,
 	common_external_ip String,
 	common_server_port Int64,
-	common_server_location String,
+	common_server_location LowCardinality(String),
 	common_server_asn String,
 	common_app_id String,
 	common_userdefine_app_name String,
-	common_app_label String,
+	common_app_label LowCardinality(String),
 	common_app_surrogate_id String,
-	common_l7_protocol String,
+	common_l7_protocol LowCardinality(String),
 	common_protocol_label String,
 	common_service_category Array(Int64),
 	common_service Int64,
-	common_l4_protocol String,
+	common_l4_protocol LowCardinality(String),
 	common_sessions Int64,
 	common_c2s_pkt_num Int64,
 	common_s2c_pkt_num Int64,
@@ -2072,8 +2153,10 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_local on cluster
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
-	common_schema_type String,
+	common_schema_type LowCardinality(String),
 	common_device_tag String,
 	common_encapsulation Int64,
 	common_tunnels String,
@@ -2200,7 +2283,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_local on cluster
 ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
 ORDER BY (common_log_id,common_data_center,common_recv_time);
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log_local on cluster ck_cluster (
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log_local ON CLUSTER ck_cluster (
 		common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -2268,6 +2351,8 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log_local on cluster ck_c
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -2309,11 +2394,9 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log_local on cluster ck_c
 ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
 ORDER BY (common_log_id,common_data_center,common_recv_time);
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip_local ON CLUSTER ck_cluster(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -2321,17 +2404,20 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip_
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 )
 ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
 ORDER BY (common_client_ip,common_server_ip,common_recv_time);
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip_local ON CLUSTER ck_cluster(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -2339,18 +2425,20 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip_
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 )
 ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
 ORDER BY (common_server_ip,common_client_ip,common_recv_time);
 
 
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id_local on cluster ck_cluster (
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain_local ON CLUSTER ck_cluster(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -2358,42 +2446,25 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_subscriber_id,common_recv_time);
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain_local on cluster ck_cluster(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 )
 ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
 ORDER BY (http_domain,common_recv_time);
 
 
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_client_ip  on cluster ck_cluster TO tsg_galaxy_v3.connection_record_log_common_client_ip_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_server_ip  on cluster ck_cluster TO tsg_galaxy_v3.connection_record_log_common_server_ip_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_subscriber_id  on cluster ck_cluster TO tsg_galaxy_v3.connection_record_log_common_subscriber_id_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_http_domain  on cluster ck_cluster TO tsg_galaxy_v3.connection_record_log_http_domain_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;
+CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_client_ip ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_common_client_ip_local AS SELECT common_log_id, common_recv_time, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni,common_schema_type,common_client_port,common_server_port,common_app_label,common_direction FROM tsg_galaxy_v3.connection_record_log_local;
+CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_server_ip ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_common_server_ip_local AS SELECT common_log_id, common_recv_time, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni,common_schema_type,common_client_port,common_server_port,common_app_label,common_direction FROM tsg_galaxy_v3.connection_record_log_local;
+CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_http_domain ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_http_domain_local AS SELECT common_log_id, common_recv_time, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni,common_schema_type,common_client_port,common_server_port,common_app_label,common_direction FROM tsg_galaxy_v3.connection_record_log_local;
 
 
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log_local ON CLUSTER ck_cluster(
 	event_timestamp Int64,
 	account String,
 	framed_ip String,
@@ -2404,7 +2475,7 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log_local on cluster ck_clu
 ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(event_timestamp))
 ORDER BY (account,event_timestamp);
 
-create table IF NOT EXISTS tsg_galaxy_v3.radius_record_log on cluster ck_query (
+create table IF NOT EXISTS tsg_galaxy_v3.radius_record_log ON CLUSTER ck_query (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -2472,6 +2543,8 @@ create table IF NOT EXISTS tsg_galaxy_v3.radius_record_log on cluster ck_query (
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -2511,7 +2584,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.radius_record_log on cluster ck_query (
 	radius_acct_interim_interval Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_record_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_query (
+create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log ON CLUSTER ck_query (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -2537,7 +2610,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_que
 	common_client_ip String,
 	common_internal_ip String,
 	common_client_port Int64,
-	common_client_location String,
+	common_client_location LowCardinality(String),
 	common_client_asn String,
 	common_subscriber_id String,
 	common_imei String,
@@ -2546,17 +2619,17 @@ create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_que
 	common_server_ip String,
 	common_external_ip String,
 	common_server_port Int64,
-	common_server_location String,
+	common_server_location LowCardinality(String),
 	common_server_asn String,
 	common_app_id String,
 	common_userdefine_app_name String,
-	common_app_label String,
+	common_app_label LowCardinality(String),
 	common_app_surrogate_id String,
-	common_l7_protocol String,
+	common_l7_protocol LowCardinality(String),
 	common_protocol_label String,
 	common_service_category Array(Int64),
 	common_service Int64,
-	common_l4_protocol String,
+	common_l4_protocol LowCardinality(String),
 	common_sessions Int64,
 	common_c2s_pkt_num Int64,
 	common_s2c_pkt_num Int64,
@@ -2579,8 +2652,10 @@ create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_que
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
-	common_schema_type String,
+	common_schema_type LowCardinality(String),
 	common_device_tag String,
 	common_encapsulation Int64,
 	common_tunnels String,
@@ -2705,7 +2780,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_que
 	rtp_originator_dir Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.proxy_event_log on cluster ck_query (
+create table IF NOT EXISTS tsg_galaxy_v3.proxy_event_log ON CLUSTER ck_query (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -2773,6 +2848,8 @@ create table IF NOT EXISTS tsg_galaxy_v3.proxy_event_log on cluster ck_query (
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -2840,7 +2917,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.proxy_event_log on cluster ck_query (
 	doh_rr String
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_event_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.security_event_log on cluster ck_query (
+create table IF NOT EXISTS tsg_galaxy_v3.security_event_log ON CLUSTER ck_query (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -2908,6 +2985,8 @@ create table IF NOT EXISTS tsg_galaxy_v3.security_event_log on cluster ck_query
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -3034,7 +3113,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.security_event_log on cluster ck_query
 	rtp_originator_dir Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,security_event_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log on cluster ck_query (
+create table IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log ON CLUSTER ck_query (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -3102,6 +3181,8 @@ create table IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log on cluster ck_qu
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -3121,7 +3202,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log on cluster ck_qu
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,sys_packet_capture_log_local,rand());
 	
 
-create table IF NOT EXISTS tsg_galaxy_v3.radius_onff_log on cluster ck_query(
+create table IF NOT EXISTS tsg_galaxy_v3.radius_onff_log ON CLUSTER ck_query(
 	event_timestamp Int64,
 	account String,
 	framed_ip String,
@@ -3132,7 +3213,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.radius_onff_log on cluster ck_query(
 ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_onff_log_local,rand());
 
 
-create table IF NOT EXISTS tsg_galaxy_v3.radius_record_log on cluster ck_cluster (
+create table IF NOT EXISTS tsg_galaxy_v3.radius_record_log ON CLUSTER ck_cluster (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -3200,6 +3281,8 @@ create table IF NOT EXISTS tsg_galaxy_v3.radius_record_log on cluster ck_cluster
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -3239,7 +3322,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.radius_record_log on cluster ck_cluster
 	radius_acct_interim_interval Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_record_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_cluster (
+create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log ON CLUSTER ck_cluster (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -3265,7 +3348,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_clu
 	common_client_ip String,
 	common_internal_ip String,
 	common_client_port Int64,
-	common_client_location String,
+	common_client_location LowCardinality(String),
 	common_client_asn String,
 	common_subscriber_id String,
 	common_imei String,
@@ -3274,17 +3357,17 @@ create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_clu
 	common_server_ip String,
 	common_external_ip String,
 	common_server_port Int64,
-	common_server_location String,
+	common_server_location LowCardinality(String),
 	common_server_asn String,
 	common_app_id String,
 	common_userdefine_app_name String,
-	common_app_label String,
+	common_app_label LowCardinality(String),
 	common_app_surrogate_id String,
-	common_l7_protocol String,
+	common_l7_protocol LowCardinality(String),
 	common_protocol_label String,
 	common_service_category Array(Int64),
 	common_service Int64,
-	common_l4_protocol String,
+	common_l4_protocol LowCardinality(String),
 	common_sessions Int64,
 	common_c2s_pkt_num Int64,
 	common_s2c_pkt_num Int64,
@@ -3307,8 +3390,10 @@ create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_clu
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
-	common_schema_type String,
+	common_schema_type LowCardinality(String),
 	common_device_tag String,
 	common_encapsulation Int64,
 	common_tunnels String,
@@ -3433,7 +3518,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.connection_record_log on cluster ck_clu
 	rtp_originator_dir Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.proxy_event_log on cluster ck_cluster (
+create table IF NOT EXISTS tsg_galaxy_v3.proxy_event_log ON CLUSTER ck_cluster (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -3501,6 +3586,8 @@ create table IF NOT EXISTS tsg_galaxy_v3.proxy_event_log on cluster ck_cluster (
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -3568,7 +3655,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.proxy_event_log on cluster ck_cluster (
 	doh_rr String
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_event_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.security_event_log on cluster ck_cluster (
+create table IF NOT EXISTS tsg_galaxy_v3.security_event_log ON CLUSTER ck_cluster (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -3636,6 +3723,8 @@ create table IF NOT EXISTS tsg_galaxy_v3.security_event_log on cluster ck_cluste
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -3762,7 +3851,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.security_event_log on cluster ck_cluste
 	rtp_originator_dir Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,security_event_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log on cluster ck_cluster (
+create table IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log ON CLUSTER ck_cluster (
 	common_recv_time Int64,
 	common_log_id UInt64,
 	common_stream_trace_id UInt64,
@@ -3830,6 +3919,8 @@ create table IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log on cluster ck_cl
 	common_first_ttl Int64,
 	common_tcp_client_isn Int64,
 	common_tcp_server_isn Int64,
+	common_mirrored_pkts Int64,
+	common_mirrored_bytes Int64,
 	common_address_type Int64,
 	common_schema_type String,
 	common_device_tag String,
@@ -3849,7 +3940,7 @@ create table IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log on cluster ck_cl
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,sys_packet_capture_log_local,rand());
 
 
-create table IF NOT EXISTS tsg_galaxy_v3.radius_onff_log on cluster ck_cluster(
+create table IF NOT EXISTS tsg_galaxy_v3.radius_onff_log ON CLUSTER ck_cluster(
 	event_timestamp Int64,
 	account String,
 	framed_ip String,
@@ -3861,18 +3952,16 @@ ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_onff_log_local,rand());
 
 
 
- create table IF NOT EXISTS `system`.tables_cluster on cluster ck_query as `system`.tables  ENGINE =Distributed(ck_all,`system`,tables,rand());
- create table IF NOT EXISTS `system`.disks_cluster on cluster ck_query as `system`.disks  ENGINE =Distributed(ck_all,`system`,disks,rand());
- create table IF NOT EXISTS `system`.parts_cluster on cluster ck_query as `system`.parts  ENGINE =Distributed(ck_all,`system`,parts,rand());
- create table IF NOT EXISTS `system`.query_log_cluster on cluster ck_query as `system`.query_log  ENGINE =Distributed(ck_all,`system`,query_log,rand());
- CREATE TABLE IF NOT EXISTS `system`.columns_cluster ON cluster ck_query AS `system`.columns ENGINE=Distributed(ck_all,`system`,columns,rand());
+ create table IF NOT EXISTS `system`.tables_cluster ON CLUSTER ck_query as `system`.tables  ENGINE =Distributed(ck_all,`system`,tables,rand());
+ create table IF NOT EXISTS `system`.disks_cluster ON CLUSTER ck_query as `system`.disks  ENGINE =Distributed(ck_all,`system`,disks,rand());
+ create table IF NOT EXISTS `system`.parts_cluster ON CLUSTER ck_query as `system`.parts  ENGINE =Distributed(ck_all,`system`,parts,rand());
+ create table IF NOT EXISTS `system`.query_log_cluster ON CLUSTER ck_query as `system`.query_log  ENGINE =Distributed(ck_all,`system`,query_log,rand());
+ CREATE TABLE IF NOT EXISTS `system`.columns_cluster ON CLUSTER ck_query AS `system`.columns ENGINE=Distributed(ck_all,`system`,columns,rand());
  
   
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip ON CLUSTER ck_cluster(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -3880,14 +3969,17 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_client_ip_local,rand());
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip ON CLUSTER ck_cluster(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -3895,16 +3987,18 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_server_ip_local,rand());
 
 
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id on cluster ck_cluster (
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain ON CLUSTER ck_cluster(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -3912,30 +4006,17 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_subscriber_id_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain on cluster ck_cluster(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_http_domain_local,rand());
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip on cluster ck_query(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip ON CLUSTER ck_query(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -3943,14 +4024,17 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_client_ip_local,rand());
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip on cluster ck_query(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip ON CLUSTER ck_query(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -3958,16 +4042,18 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_server_ip_local,rand());
 
 
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id on cluster ck_query (
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain ON CLUSTER ck_query(
 	common_log_id UInt64,
 	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
 	common_server_ip String,
 	common_client_ip String,
 	common_sled_ip String,
@@ -3975,34 +4061,23 @@ CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber
 	common_subscriber_id String,
 	common_stream_trace_id UInt64,
 	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_subscriber_id_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain on cluster ck_query(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
+	ssl_sni  String,
+	common_schema_type LowCardinality(String),
+	common_client_port Int64,
+	common_server_port Int64,
+	common_app_label LowCardinality(String),
+	common_direction Int64
 ) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_http_domain_local,rand());
 
 
 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log_local on cluster ck_cluster(
+CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log_local ON CLUSTER ck_cluster(
 common_log_id UInt64,
 common_recv_time Int64,
 common_entrance_id Int64,
 common_device_id String,
 common_egress_link_id Nullable(Int64),
-common_ingress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
 common_policy_id Int64,
 common_user_region String,
 ad_method String,
@@ -4024,13 +4099,13 @@ ad_generate_time Int64
 )
 ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
 
-create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log on cluster ck_query(
+create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log ON CLUSTER ck_query(
 common_log_id UInt64,
 common_recv_time Int64,
 common_entrance_id Int64,
 common_device_id String,
 common_egress_link_id Nullable(Int64),
-common_ingress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
 common_policy_id Int64,
 common_user_region String,
 ad_method String,
@@ -4052,13 +4127,13 @@ ad_generate_time Int64
 )
 ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,active_defence_event_log_local,rand());
 
-create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log on cluster ck_cluster(
+create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log ON CLUSTER ck_cluster(
 common_log_id UInt64,
 common_recv_time Int64,
 common_entrance_id Int64,
 common_device_id String,
 common_egress_link_id Nullable(Int64),
-common_ingress_link_id Nullable(Int64),
+	common_ingress_link_id Nullable(Int64),
 common_policy_id Int64,
 common_user_region String,
 ad_method String,
@@ -4079,15 +4154,10 @@ ad_cc_rejected_connection_num Int64,
 ad_generate_time Int64
 )
 ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,active_defence_event_log_local,rand());
-
-
-
-DROP DICTIONARY IF EXISTS tsg_galaxy_v3.cdn on cluster ck_cluster;
-
 CREATE DICTIONARY IF NOT EXISTS tsg_galaxy_v3.cdn on cluster ck_cluster (
 cdn_id UInt64,
  domain String,
- cname String) PRIMARY KEY cdn_id SOURCE(MYSQL(PORT {{ bifang_mariadb_port }} USER 'root' PASSWORD '{{ bifang_mariadb_pin }}' REPLICA (HOST '{{ bifang_mariadb_host }}' PRIORITY 1) DB 'tsg-bifang' TABLE 'tsg_cdn_domain_info')) LIFETIME(MIN 300 MAX 400) LAYOUT(FLAT());
+ cname String) PRIMARY KEY cdn_id SOURCE(MYSQL(PORT {{ bifang_mariadb_port }} USER 'root' PASSWORD '{{ bifang_mariadb_pin }}' REPLICA (HOST '{{ bifang_mariadb_host }}' PRIORITY 1) DB '{{ bifang_mariadb_database }}' TABLE 'tsg_cdn_domain_info')) LIFETIME(MIN 300 MAX 400) LAYOUT(FLAT());
 
  create table IF NOT EXISTS tsg_galaxy_v3.cdn_dic on cluster ck_cluster (`cdn_id` UInt64,
  `domain` String,
@@ -4199,6 +4269,4 @@ create table IF NOT EXISTS tsg_galaxy_v3.proxy_ip_info on cluster ck_query (
 stat_time Int64,
 	policy_id Int64,
 	ip_list AggregateFunction(groupUniqArray,String)
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_ip_info_local,rand());
-
-
+) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_ip_info_local,rand());
\ No newline at end of file
diff --git a/parcels/roles/init/clickhouse/templates/create_ck_table.sql_21.06 b/parcels/roles/init/clickhouse/templates/create_ck_table.sql_21.06
deleted file mode 100644
index 2d4f882..0000000
--- a/parcels/roles/init/clickhouse/templates/create_ck_table.sql_21.06
+++ /dev/null
@@ -1,4022 +0,0 @@
-create database IF NOT EXISTS tsg_galaxy_v3 ON CLUSTER ck_cluster;
-create database IF NOT EXISTS tsg_galaxy_v3 ON CLUSTER ck_query;
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log_local ON CLUSTER ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	gtp_version String,
-	gtp_apn String,
-	gtp_imei String,
-	gtp_imsi String,
-	gtp_phone_number String,
-	gtp_uplink_teid Int64,
-	gtp_downlink_teid Int64,
-	gtp_msg_type String,
-	gtp_end_user_ipv4 String,
-	gtp_end_user_ipv6 String
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_log_id,common_data_center,common_recv_time);
-
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log ON CLUSTER ck_cluster(
-		common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	gtp_version String,
-	gtp_apn String,
-	gtp_imei String,
-	gtp_imsi String,
-	gtp_phone_number String,
-	gtp_uplink_teid Int64,
-	gtp_downlink_teid Int64,
-	gtp_msg_type String,
-	gtp_end_user_ipv4 String,
-	gtp_end_user_ipv6 String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,gtpc_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.gtpc_record_log ON CLUSTER ck_query(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	gtp_version String,
-	gtp_apn String,
-	gtp_imei String,
-	gtp_imsi String,
-	gtp_phone_number String,
-	gtp_uplink_teid Int64,
-	gtp_downlink_teid Int64,
-	gtp_msg_type String,
-	gtp_end_user_ipv4 String,
-	gtp_end_user_ipv6 String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,gtpc_record_log_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log_local ON CLUSTER ck_cluster(
-		common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_log_id,common_data_center,common_recv_time);
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log_local ON CLUSTER ck_cluster(
-		common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_stream_trace_id,common_data_center,common_recv_time);
-
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log ON CLUSTER ck_query(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,live_session_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.live_session_record_log ON CLUSTER ck_cluster(
-		common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,live_session_record_log_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log ON CLUSTER ck_query(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,transaction_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.transaction_record_log ON CLUSTER ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,transaction_record_log_local,rand());
-
-
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log_local ON CLUSTER ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-)ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_data_center,common_recv_time);
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log ON CLUSTER ck_query(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,voip_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.voip_record_log ON CLUSTER ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,voip_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log_local ON CLUSTER ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	nic_name String,
-	origin_source_mac String,
-	origin_dest_mac String,
-	packet_url String,
-	pcap_storage_task_id Int64,
-	pcap_storage_duration Int64
-)
-ENGINE =MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log_local ON CLUSTER ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-	
-)
-ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log_local ON CLUSTER ck_cluster(
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	doh_url String,
-	doh_host String,
-	doh_request_line String,
-	doh_response_line String,
-	doh_cookie String,
-	doh_referer String,
-	doh_user_agent String,
-	doh_content_length String,
-	doh_content_type String,
-	doh_set_cookie String,
-	doh_version String,
-	doh_message_id Int64,
-	doh_qr Int64,
-	doh_opcode Int64,
-	doh_aa Int64,
-	doh_tc Int64,
-	doh_rd Int64,
-	doh_ra Int64,
-	doh_rcode Int64,
-	doh_qdcount Int64,
-	doh_ancount Int64,
-	doh_nscount Int64,
-	doh_arcount Int64,
-	doh_qname String,
-	doh_qtype Int64,
-	doh_qclass Int64,
-	doh_cname String,
-	doh_sub Int64,
-	doh_rr String
-)
-ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_local ON CLUSTER ck_cluster(
-		common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_log_id,common_data_center,common_recv_time);
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log_local ON CLUSTER ck_cluster (
-		common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	radius_packet_type Int64,
-	radius_nas_ip String,
-	radius_framed_ip String,
-	radius_account String,
-	radius_session_timeout Int64,
-	radius_idle_timeout Int64,
-	radius_acct_status_type Int64,
-	radius_acct_terminate_cause Int64,
-	radius_event_timestamp Int64,
-	radius_nas_port Int64,
-	radius_service_type Int64,
-	radius_framed_protocol Int64,
-	radius_callback_number String,
-	radius_callback_id String,
-	radius_termination_action Nullable(Int64),
-	radius_called_station_id String,
-	radius_calling_station_id String,
-	radius_acct_delay_time Int64,
-	radius_acct_session_id String,
-	radius_acct_multi_session_id String,
-	radius_acct_input_octets Int64,
-	radius_acct_output_octets Int64,
-	radius_acct_input_packets Int64,
-	radius_acct_output_packets Int64,
-	radius_acct_session_time Int64,
-	radius_acct_link_count Int64,
-	radius_acct_interim_interval Int64
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_log_id,common_data_center,common_recv_time);
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip_local ON CLUSTER ck_cluster(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_client_ip,common_server_ip,common_recv_time);
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip_local ON CLUSTER ck_cluster(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_server_ip,common_client_ip,common_recv_time);
-
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id_local ON CLUSTER ck_cluster (
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (common_subscriber_id,common_recv_time);
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain_local ON CLUSTER ck_cluster(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time))
-ORDER BY (http_domain,common_recv_time);
-
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_client_ip  ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_common_client_ip_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_server_ip  ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_common_server_ip_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_subscriber_id  ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_common_subscriber_id_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.common_http_domain  ON CLUSTER ck_cluster TO tsg_galaxy_v3.connection_record_log_http_domain_local  AS SELECT common_log_id, common_recv_time, common_policy_id, common_action, common_server_ip, common_client_ip, common_sled_ip, common_entrance_id, common_subscriber_id, common_stream_trace_id, http_domain, ssl_sni FROM tsg_galaxy_v3.connection_record_log_local;
-
-
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log_local ON CLUSTER ck_cluster(
-	event_timestamp Int64,
-	account String,
-	framed_ip String,
-	acct_status_type Int64,
-	acct_session_id String,
-	acct_session_time Int64
-)
-ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(event_timestamp))
-ORDER BY (account,event_timestamp);
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log ON CLUSTER ck_query (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	radius_packet_type Int64,
-	radius_nas_ip String,
-	radius_framed_ip String,
-	radius_account String,
-	radius_session_timeout Int64,
-	radius_idle_timeout Int64,
-	radius_acct_status_type Int64,
-	radius_acct_terminate_cause Int64,
-	radius_event_timestamp Int64,
-	radius_nas_port Int64,
-	radius_service_type Int64,
-	radius_framed_protocol Int64,
-	radius_callback_number String,
-	radius_callback_id String,
-	radius_termination_action Nullable(Int64),
-	radius_called_station_id String,
-	radius_calling_station_id String,
-	radius_acct_delay_time Int64,
-	radius_acct_session_id String,
-	radius_acct_multi_session_id String,
-	radius_acct_input_octets Int64,
-	radius_acct_output_octets Int64,
-	radius_acct_input_packets Int64,
-	radius_acct_output_packets Int64,
-	radius_acct_session_time Int64,
-	radius_acct_link_count Int64,
-	radius_acct_interim_interval Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log ON CLUSTER ck_query (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log ON CLUSTER ck_query (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	doh_url String,
-	doh_host String,
-	doh_request_line String,
-	doh_response_line String,
-	doh_cookie String,
-	doh_referer String,
-	doh_user_agent String,
-	doh_content_length String,
-	doh_content_type String,
-	doh_set_cookie String,
-	doh_version String,
-	doh_message_id Int64,
-	doh_qr Int64,
-	doh_opcode Int64,
-	doh_aa Int64,
-	doh_tc Int64,
-	doh_rd Int64,
-	doh_ra Int64,
-	doh_rcode Int64,
-	doh_qdcount Int64,
-	doh_ancount Int64,
-	doh_nscount Int64,
-	doh_arcount Int64,
-	doh_qname String,
-	doh_qtype Int64,
-	doh_qclass Int64,
-	doh_cname String,
-	doh_sub Int64,
-	doh_rr String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_event_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log ON CLUSTER ck_query (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,security_event_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log ON CLUSTER ck_query (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	nic_name String,
-	origin_source_mac String,
-	origin_dest_mac String,
-	packet_url String,
-	pcap_storage_task_id Int64,
-	pcap_storage_duration Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,sys_packet_capture_log_local,rand());
-	
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log ON CLUSTER ck_query(
-	event_timestamp Int64,
-	account String,
-	framed_ip String,
-	acct_status_type Int64,
-	acct_session_id String,
-	acct_session_time Int64
-)
-ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_onff_log_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_record_log ON CLUSTER ck_cluster (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	radius_packet_type Int64,
-	radius_nas_ip String,
-	radius_framed_ip String,
-	radius_account String,
-	radius_session_timeout Int64,
-	radius_idle_timeout Int64,
-	radius_acct_status_type Int64,
-	radius_acct_terminate_cause Int64,
-	radius_event_timestamp Int64,
-	radius_nas_port Int64,
-	radius_service_type Int64,
-	radius_framed_protocol Int64,
-	radius_callback_number String,
-	radius_callback_id String,
-	radius_termination_action Nullable(Int64),
-	radius_called_station_id String,
-	radius_calling_station_id String,
-	radius_acct_delay_time Int64,
-	radius_acct_session_id String,
-	radius_acct_multi_session_id String,
-	radius_acct_input_octets Int64,
-	radius_acct_output_octets Int64,
-	radius_acct_input_packets Int64,
-	radius_acct_output_packets Int64,
-	radius_acct_session_time Int64,
-	radius_acct_link_count Int64,
-	radius_acct_interim_interval Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log ON CLUSTER ck_cluster (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_event_log ON CLUSTER ck_cluster (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	doh_url String,
-	doh_host String,
-	doh_request_line String,
-	doh_response_line String,
-	doh_cookie String,
-	doh_referer String,
-	doh_user_agent String,
-	doh_content_length String,
-	doh_content_type String,
-	doh_set_cookie String,
-	doh_version String,
-	doh_message_id Int64,
-	doh_qr Int64,
-	doh_opcode Int64,
-	doh_aa Int64,
-	doh_tc Int64,
-	doh_rd Int64,
-	doh_ra Int64,
-	doh_rcode Int64,
-	doh_qdcount Int64,
-	doh_ancount Int64,
-	doh_nscount Int64,
-	doh_arcount Int64,
-	doh_qname String,
-	doh_qtype Int64,
-	doh_qclass Int64,
-	doh_cname String,
-	doh_sub Int64,
-	doh_rr String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_event_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_event_log ON CLUSTER ck_cluster (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	http_url String,
-	http_host String,
-	http_domain String,
-	http_request_line String,
-	http_response_line String,
-	http_request_header String,
-	http_response_header String,
-	http_request_content String,
-	http_response_content String,
-	http_request_body String,
-	http_response_body String,
-	http_request_body_key String,
-	http_response_body_key String,
-	http_proxy_flag Int64,
-	http_sequence Int64,
-	http_snapshot String,
-	http_cookie String,
-	http_referer String,
-	http_user_agent String,
-	http_content_length String,
-	http_content_type String,
-	http_set_cookie String,
-	http_version String,
-	http_response_lantency_ms Int64,
-	http_session_duration_ms Int64,
-	http_action_file_size Int64,
-	mail_protocol_type String,
-	mail_account String,
-	mail_to_cmd String,
-	mail_from_cmd String,
-	mail_from String,
-	mail_to String,
-	mail_cc String,
-	mail_bcc String,
-	mail_subject String,
-	mail_subject_charset String,
-	mail_content String,
-	mail_content_charset String,
-	mail_attachment_name String,
-	mail_attachment_name_charset String,
-	mail_attachment_content String,
-	mail_eml_file String,
-	mail_snapshot String,
-	dns_message_id Int64,
-	dns_qr Nullable(Int64),
-	dns_opcode Nullable(Int64),
-	dns_aa Int64,
-	dns_tc Int64,
-	dns_rd Int64,
-	dns_ra Int64,
-	dns_rcode Int64,
-	dns_qdcount Int64,
-	dns_ancount Int64,
-	dns_nscount Int64,
-	dns_arcount Int64,
-	dns_qname String,
-	dns_qtype Int64,
-	dns_qclass Int64,
-	dns_cname String,
-	dns_sub Int64,
-	dns_rr String,
-	ssl_version String,
-	ssl_sni String,
-	ssl_san String,
-	ssl_cn String,
-	ssl_pinningst Nullable(Int64),
-	ssl_intercept_state Nullable(Int64),
-	ssl_server_side_latency Int64,
-	ssl_client_side_latency Int64,
-	ssl_server_side_version String,
-	ssl_client_side_version String,
-	ssl_cert_verify Nullable(Int64),
-	ssl_error String,
-	ssl_con_latency_ms Int64,
-	ssl_ja3_fingerprint String,
-	ssl_ja3_hash String,
-	ssl_cert_issuer String,
-	ssl_cert_subject String,
-	quic_version String,
-	quic_sni String,
-	quic_user_agent String,
-	ftp_account String,
-	ftp_url String,
-	ftp_content String,
-	ftp_link_type String,
-	bgp_type Int64,
-	bgp_as_num String,
-	bgp_route String,
-	voip_calling_account String,
-	voip_called_account String,
-	voip_calling_number String,
-	voip_called_number String,
-	streaming_media_url String,
-	streaming_media_protocol String,
-	app_extra_info String,
-	sip_call_id String,
-	sip_originator_description String,
-	sip_responder_description String,
-	sip_user_agent String,
-	sip_server String,
-	sip_originator_sdp_connect_ip String,
-	sip_originator_sdp_media_port Int64,
-	sip_originator_sdp_media_type String,
-	sip_originator_sdp_content String,
-	sip_responder_sdp_connect_ip String,
-	sip_responder_sdp_media_port Int64,
-	sip_responder_sdp_media_type String,
-	sip_responder_sdp_content String,
-	sip_duration Int64,
-	sip_bye String,
-	rtp_payload_type_c2s Nullable(Int64),
-	rtp_payload_type_s2c Nullable(Int64),
-	rtp_pcap_path String,
-	rtp_originator_dir Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,security_event_log_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.sys_packet_capture_log ON CLUSTER ck_cluster (
-	common_recv_time Int64,
-	common_log_id UInt64,
-	common_stream_trace_id UInt64,
-	common_direction Nullable(Int64),
-	common_stream_dir Int64,
-	common_start_time Int64,
-	common_end_time Int64,
-	common_con_duration_ms Int64,
-	common_establish_latency_ms Int64,
-	common_processing_time Int64,
-	common_entrance_id Int64,
-	common_device_id String,
-	common_link_id Int64,
-	common_isp String,
-	common_data_center String,
-	common_sled_ip String,
-	common_action Int64,
-	common_sub_action String,
-	common_policy_id Int64,
-	common_user_tags String,
-	common_user_region String,
-	common_client_ip String,
-	common_internal_ip String,
-	common_client_port Int64,
-	common_client_location String,
-	common_client_asn String,
-	common_subscriber_id String,
-	common_imei String,
-	common_imsi String,
-	common_phone_number String,
-	common_server_ip String,
-	common_external_ip String,
-	common_server_port Int64,
-	common_server_location String,
-	common_server_asn String,
-	common_app_id String,
-	common_app_label String,
-	common_app_surrogate_id String,
-	common_l7_protocol String,
-	common_protocol_label String,
-	common_service_category Array(Int64),
-	common_service Int64,
-	common_l4_protocol String,
-	common_sessions Int64,
-	common_c2s_pkt_num Int64,
-	common_s2c_pkt_num Int64,
-	common_c2s_pkt_diff Int64,
-	common_s2c_pkt_diff Int64,
-	common_c2s_byte_num Int64,
-	common_s2c_byte_num Int64,
-	common_c2s_byte_diff Int64,
-	common_s2c_byte_diff Int64,
-	common_c2s_ipfrag_num Int64,
-	common_s2c_ipfrag_num Int64,
-	common_c2s_tcp_lostlen Int64,
-	common_s2c_tcp_lostlen Int64,
-	common_c2s_tcp_unorder_num Int64,
-	common_s2c_tcp_unorder_num Int64,
-	common_c2s_pkt_retrans Int64,
-	common_s2c_pkt_retrans Int64,
-	common_c2s_byte_retrans Int64,
-	common_s2c_byte_retrans Int64,
-	common_first_ttl Int64,
-	common_tcp_client_isn Int64,
-	common_tcp_server_isn Int64,
-	common_address_type Int64,
-	common_schema_type String,
-	common_device_tag String,
-	common_encapsulation Int64,
-	common_tunnels String,
-	common_address_list String,
-	common_has_dup_traffic Int64,
-	common_stream_error String,
-	common_link_info_c2s String,
-	common_link_info_s2c String,
-	nic_name String,
-	origin_source_mac String,
-	origin_dest_mac String,
-	packet_url String,
-	pcap_storage_task_id Int64,
-	pcap_storage_duration Int64
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,sys_packet_capture_log_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.radius_onff_log ON CLUSTER ck_cluster(
-	event_timestamp Int64,
-	account String,
-	framed_ip String,
-	acct_status_type Int64,
-	acct_session_id String,
-	acct_session_time Int64
-)
-ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,radius_onff_log_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip ON CLUSTER ck_cluster(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_client_ip_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip ON CLUSTER ck_cluster(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_server_ip_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id ON CLUSTER ck_cluster (
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_subscriber_id_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain ON CLUSTER ck_cluster(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_http_domain_local,rand());
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_client_ip ON CLUSTER ck_query(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_client_ip_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_server_ip ON CLUSTER ck_query(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_server_ip_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_common_subscriber_id ON CLUSTER ck_query (
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_common_subscriber_id_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.connection_record_log_http_domain ON CLUSTER ck_query(
-	common_log_id UInt64,
-	common_recv_time Int64,
-	common_policy_id Int64,
-	common_action Int64,
-	common_server_ip String,
-	common_client_ip String,
-	common_sled_ip String,
-	common_entrance_id Int64,
-	common_subscriber_id String,
-	common_stream_trace_id UInt64,
-	http_domain String,
-	ssl_sni  String
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,connection_record_log_http_domain_local,rand());
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log_local on cluster ck_cluster(
-common_log_id UInt64,
-common_recv_time Int64,
-common_entrance_id Int64,
-common_device_id String,
-common_link_id Int64,
-common_policy_id Int64,
-common_user_region String,
-ad_method String,
-ad_protocol String,
-common_address_type Int64,
-ad_target_ip String,
-ad_target_port String,
-ad_cc_target_url String,
-ad_target_ip_location String,
-ad_target_ip_asn String,
-ad_claimed_src_ip_profile_id Int64,
-ad_reflector_profile_id Int64,
-ad_sent_pkt_num Int64,
-ad_sent_byte_num Int64,
-ad_cc_initiate_connection_num Int64,
-ad_cc_established_connection_num Int64,
-ad_cc_rejected_connection_num Int64,
-ad_generate_time Int64
-)
-ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
-
-create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log on cluster ck_query(
-common_log_id UInt64,
-common_recv_time Int64,
-common_entrance_id Int64,
-common_device_id String,
-common_link_id Int64,
-common_policy_id Int64,
-common_user_region String,
-ad_method String,
-ad_protocol String,
-common_address_type Int64,
-ad_target_ip String,
-ad_target_port String,
-ad_cc_target_url String,
-ad_target_ip_location String,
-ad_target_ip_asn String,
-ad_claimed_src_ip_profile_id Int64,
-ad_reflector_profile_id Int64,
-ad_sent_pkt_num Int64,
-ad_sent_byte_num Int64,
-ad_cc_initiate_connection_num Int64,
-ad_cc_established_connection_num Int64,
-ad_cc_rejected_connection_num Int64,
-ad_generate_time Int64
-)
-ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,active_defence_event_log_local,rand());
-
-create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log on cluster ck_cluster(
-common_log_id UInt64,
-common_recv_time Int64,
-common_entrance_id Int64,
-common_device_id String,
-common_link_id Int64,
-common_policy_id Int64,
-common_user_region String,
-ad_method String,
-ad_protocol String,
-common_address_type Int64,
-ad_target_ip String,
-ad_target_port String,
-ad_cc_target_url String,
-ad_target_ip_location String,
-ad_target_ip_asn String,
-ad_claimed_src_ip_profile_id Int64,
-ad_reflector_profile_id Int64,
-ad_sent_pkt_num Int64,
-ad_sent_byte_num Int64,
-ad_cc_initiate_connection_num Int64,
-ad_cc_established_connection_num Int64,
-ad_cc_rejected_connection_num Int64,
-ad_generate_time Int64
-)
-ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,active_defence_event_log_local,rand());
-
-
- CREATE TABLE IF NOT EXISTS `system`.tables_cluster ON CLUSTER ck_query as `system`.tables  ENGINE =Distributed(ck_all,`system`,tables,rand());
- CREATE TABLE IF NOT EXISTS `system`.disks_cluster ON CLUSTER ck_query as `system`.disks  ENGINE =Distributed(ck_all,`system`,disks,rand());
- CREATE TABLE IF NOT EXISTS `system`.parts_cluster ON CLUSTER ck_query as `system`.parts  ENGINE =Distributed(ck_all,`system`,parts,rand());
- CREATE TABLE IF NOT EXISTS `system`.query_log_cluster ON CLUSTER ck_query as `system`.query_log  ENGINE =Distributed(ck_all,`system`,query_log,rand());
- CREATE TABLE IF NOT EXISTS `system`.columns_cluster ON cluster ck_query AS `system`.columns ENGINE=Distributed(ck_all,`system`,columns,rand());
- 
-
diff --git a/parcels/roles/init/clickhouse/templates/dll.sql b/parcels/roles/init/clickhouse/templates/dll.sql
deleted file mode 100644
index db34b5a..0000000
--- a/parcels/roles/init/clickhouse/templates/dll.sql
+++ /dev/null
@@ -1,200 +0,0 @@
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log_local on cluster ck_cluster(
-common_log_id UInt64,
-common_recv_time Int64,
-common_entrance_id Int64,
-common_device_id String,
-common_link_id Int64,
-common_policy_id Int64,
-common_user_region String,
-ad_method String,
-ad_protocol String,
-common_address_type Int64,
-ad_target_ip String,
-ad_target_port String,
-ad_cc_target_url String,
-ad_target_ip_location String,
-ad_target_ip_asn String,
-ad_claimed_src_ip_profile_id Int64,
-ad_reflector_profile_id Int64,
-ad_sent_pkt_num Int64,
-ad_sent_byte_num Int64,
-ad_cc_initiate_connection_num Int64,
-ad_cc_established_connection_num Int64,
-ad_cc_rejected_connection_num Int64,
-ad_generate_time Int64
-)
-ENGINE = MergeTree PARTITION BY toYYYYMMDD(toDate(common_recv_time)) ORDER BY (common_log_id,common_policy_id,common_recv_time);
-
-create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log on cluster ck_query(
-common_log_id UInt64,
-common_recv_time Int64,
-common_entrance_id Int64,
-common_device_id String,
-common_link_id Int64,
-common_policy_id Int64,
-common_user_region String,
-ad_method String,
-ad_protocol String,
-common_address_type Int64,
-ad_target_ip String,
-ad_target_port String,
-ad_cc_target_url String,
-ad_target_ip_location String,
-ad_target_ip_asn String,
-ad_claimed_src_ip_profile_id Int64,
-ad_reflector_profile_id Int64,
-ad_sent_pkt_num Int64,
-ad_sent_byte_num Int64,
-ad_cc_initiate_connection_num Int64,
-ad_cc_established_connection_num Int64,
-ad_cc_rejected_connection_num Int64,
-ad_generate_time Int64
-)
-ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,active_defence_event_log_local,rand());
-
-create table IF NOT EXISTS tsg_galaxy_v3.active_defence_event_log on cluster ck_cluster(
-common_log_id UInt64,
-common_recv_time Int64,
-common_entrance_id Int64,
-common_device_id String,
-common_link_id Int64,
-common_policy_id Int64,
-common_user_region String,
-ad_method String,
-ad_protocol String,
-common_address_type Int64,
-ad_target_ip String,
-ad_target_port String,
-ad_cc_target_url String,
-ad_target_ip_location String,
-ad_target_ip_asn String,
-ad_claimed_src_ip_profile_id Int64,
-ad_reflector_profile_id Int64,
-ad_sent_pkt_num Int64,
-ad_sent_byte_num Int64,
-ad_cc_initiate_connection_num Int64,
-ad_cc_established_connection_num Int64,
-ad_cc_rejected_connection_num Int64,
-ad_generate_time Int64
-)
-ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,active_defence_event_log_local,rand());
-
-
-
-CREATE DICTIONARY IF NOT EXISTS cdn on cluster ck_cluster (
-cdn_id UInt64,
- domain String,
- cname String) PRIMARY KEY cdn_id SOURCE(MYSQL(PORT 3306 USER 'root' PASSWORD 'bifang!@#' REPLICA (HOST '192.168.44.71' PRIORITY 1) DB 'tsg-bifang' TABLE 'tsg_cdn_domain_info')) LIFETIME(MIN 300 MAX 400) LAYOUT(FLAT());
-
- create table IF NOT EXISTS tsg_galaxy_v3.cdn_dic on cluster ck_cluster (`cdn_id` UInt64,
- `domain` String,
- `cname` String) Engine = Dictionary(cdn);
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_website_domain_info_local  on cluster ck_cluster(
-	stat_time Int64,
-	policy_id Int64,
-	domain String,
-	ip_list AggregateFunction(groupUniqArray,String),
-	cdn_list AggregateFunction(groupUniqArray,String),
-	protocol_type_list AggregateFunction(groupUniqArray,String),
-	port_list  AggregateFunction(groupUniqArray,Int64)
-) ENGINE = AggregatingMergeTree PARTITION BY toYYYYMMDD(toDate(stat_time)) ORDER BY (policy_id,domain,stat_time) SETTINGS index_granularity = 8192;
-
-
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.security_website_domain_info_local_view  on cluster ck_cluster TO tsg_galaxy_v3.security_website_domain_info_local (
-stat_time UInt32,
-policy_id Int64,
-domain String,
-ip_list AggregateFunction(groupUniqArray,
- String),
- cdn_list AggregateFunction(groupUniqArray,
- String),
- protocol_type_list AggregateFunction(groupUniqArray,
- String),
- port_list AggregateFunction(groupUniqArray,
- Int64)) AS SELECT toUnixTimestamp(toStartOfDay(toDate(common_recv_time))) AS stat_time,
- common_policy_id AS policy_id,
- http_domain AS domain,
- groupUniqArrayState(common_server_ip) AS ip_list,
- groupUniqArrayState(cc.domain) AS cdn_list,
- groupUniqArrayState(common_schema_type) AS protocol_type_list,
- groupUniqArrayState(common_server_port) AS port_list FROM (SELECT common_recv_time,
- common_policy_id,
- http_domain,
- common_server_ip,
- arrayJoin(splitByChar(';',
- replaceAll(ssl_san,
- '*',
- ''))) AS san,
- common_schema_type,
- common_server_port FROM tsg_galaxy_v3.security_event_log_local) AS sell INNER JOIN tsg_galaxy_v3.cdn_dic AS cc ON sell.san = cc.domain GROUP BY toStartOfDay(toDate(common_recv_time)),
- common_policy_id,
- http_domain;
- 
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.security_ip_info_local  on cluster ck_cluster (
-	stat_time Int64,
-	policy_id Int64,
-	ip String,
-	domain_list AggregateFunction(groupUniqArray,String),
-	port_list  AggregateFunction(groupUniqArray,Int64)
-) ENGINE = AggregatingMergeTree PARTITION BY toYYYYMMDD(toDate(stat_time)) ORDER BY (policy_id,ip,stat_time) SETTINGS index_granularity = 8192;
-
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.security_ip_info_local_view  on cluster ck_cluster TO tsg_galaxy_v3.security_ip_info_local AS
-SELECT
-	toUnixTimestamp(toStartOfDay(toDate(common_recv_time))) as stat_time,
-	common_policy_id as policy_id,
-	common_server_ip as ip,
-	groupUniqArrayState(http_domain) as domain_list ,
-	groupUniqArrayState(common_server_port) as port_list
-FROM
-	tsg_galaxy_v3.security_event_log_local
-group BY
-	toStartOfDay(toDate(common_recv_time)),
-	common_policy_id,
-	common_server_ip;
-
-
-CREATE TABLE IF NOT EXISTS tsg_galaxy_v3.proxy_ip_info_local  on cluster ck_cluster(
-	stat_time Int64,
-	policy_id Int64,
-	ip_list AggregateFunction(groupUniqArray,String)
-) ENGINE = AggregatingMergeTree PARTITION BY toYYYYMMDD(toDate(stat_time)) ORDER BY (policy_id,stat_time) SETTINGS index_granularity = 8192;
-
-
-CREATE MATERIALIZED VIEW IF NOT EXISTS tsg_galaxy_v3.proxy_ip_info_local_view on cluster ck_cluster TO tsg_galaxy_v3.proxy_ip_info_local   (
- stat_time UInt32,
- policy_id Int64,
- ip_list AggregateFunction(groupUniqArray,
- String)) AS SELECT toUnixTimestamp(toStartOfMinute(toDateTime(common_recv_time))) AS stat_time,
- common_policy_id AS policy_id,
- groupUniqArrayState(common_client_ip) AS ip_list FROM tsg_galaxy_v3.proxy_event_log_local GROUP BY toStartOfMinute(toDateTime(common_recv_time)),
- common_policy_id;
-
-create table IF NOT EXISTS tsg_galaxy_v3.security_website_domain_info on cluster ck_query 
-(
-	stat_time Int64,
-	policy_id Int64,
-	domain String,
-	ip_list AggregateFunction(groupUniqArray,String),
-	cdn_list AggregateFunction(groupUniqArray,String),
-	protocol_type_list AggregateFunction(groupUniqArray,String),
-	port_list  AggregateFunction(groupUniqArray,Int64)
-)
-ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,security_website_domain_info_local,rand());
-
-create table IF NOT EXISTS tsg_galaxy_v3.security_ip_info on cluster ck_query (
-stat_time Int64,
-	policy_id Int64,
-	ip String,
-	domain_list AggregateFunction(groupUniqArray,String),
-	port_list  AggregateFunction(groupUniqArray,Int64)
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,security_ip_info_local,rand());
-
-create table IF NOT EXISTS tsg_galaxy_v3.proxy_ip_info on cluster ck_query (
-stat_time Int64,
-	policy_id Int64,
-	ip_list AggregateFunction(groupUniqArray,String)
-) ENGINE =Distributed(ck_cluster,tsg_galaxy_v3,proxy_ip_info_local,rand());
-
diff --git a/parcels/roles/init/dos-baseline/tasks/init_dos.yml b/parcels/roles/init/dos-baseline/tasks/init_dos.yml
new file mode 100644
index 0000000..dad8736
--- /dev/null
+++ b/parcels/roles/init/dos-baseline/tasks/init_dos.yml
@@ -0,0 +1,57 @@
+- name: check jdk 1.8_73
+  shell: source /etc/profile && java -version 2>&1 | grep 1.8.0_73 | wc -l
+  ignore_errors: false
+  register: jdk_out
+
+- name: To terminate execution
+  fail:
+    msg: "检测到目标集群内存在JDK未安装节点，请检查"
+  when: jdk_out.stdout != '2'
+  run_once: true
+  delegate_to: 127.0.0.1
+
+- name: create dos-baseline package path:{{ install_path }}
+  file:
+    state: directory
+    path: '{{ install_path }}'
+
+- name: get zookeeper_servers to ansible variable
+  set_fact: zookeeper_servers="{{groups.zookeeper[0]}},{{groups.zookeeper[1]}},{{groups.zookeeper[2]}}"
+  when: '(groups.zookeeper|length) == 3'
+  
+- name: get zookeeper_servers to ansible variable
+  set_fact: zookeeper_servers="{{groups.zookeeper[0]}},{{groups.zookeeper[1]}},{{groups.zookeeper[2]}},{{groups.zookeeper[3]}},{{groups.zookeeper[4]}}"
+  when: '(groups.zookeeper|length) >= 5'
+
+- name: master_ip from ansible variable
+  set_fact: master_ip="{{groups.dos_baseline[0]}}"
+
+- name: copy program pkg to destination:{{ master_ip }}
+  unarchive:
+    src: "{{ package_path }}/dos-baseline.tar.gz"
+    dest: "{{ install_path }}"
+    force: true
+    backup: yes
+  delegate_to: "{{ master_ip }}"
+
+- name: copy configuration
+  template: 
+    src: 'application.properties.j2'
+    dest: '{{ install_path }}/dos-baseline/application.properties'
+    mode: 0644
+    backup: yes
+  delegate_to: "{{ master_ip }}"
+
+#- name: start dos-baseline
+#  shell: sh {{ install_path }}/dos-baseline/start.sh
+#  run_once: true
+#  delegate_to: "{{ master_ip }}"
+
+- name: add crontab task to schedule dos-baseline
+  cron: 
+    name: 'dos-baseline'
+    hour: "3"
+    weekday: "1"
+    job: '/bin/sh {{ install_path }}/dos-baseline/start.sh'
+    user: root
+  delegate_to: "{{ master_ip }}"
diff --git a/parcels/roles/init/dos-baseline/tasks/main.yml b/parcels/roles/init/dos-baseline/tasks/main.yml
new file mode 100644
index 0000000..3865a0f
--- /dev/null
+++ b/parcels/roles/init/dos-baseline/tasks/main.yml
@@ -0,0 +1 @@
+- include: init_dos.yml
diff --git a/parcels/roles/init/dos-baseline/templates/application.properties.j2 b/parcels/roles/init/dos-baseline/templates/application.properties.j2
new file mode 100644
index 0000000..63f6b63
--- /dev/null
+++ b/parcels/roles/init/dos-baseline/templates/application.properties.j2
@@ -0,0 +1,78 @@
+##########################################
+############## 数据库配置 ###############
+##########################################
+#Druid配置
+druid.url=jdbc:avatica:remote:url=http://{{ gateway_keepalive_host }}:8089/druid/v2/sql/avatica/
+druid.driver=org.apache.calcite.avatica.remote.Driver
+druid.table=traffic_top_destination_ip_metrics_log
+
+#HBase配置
+hbase.table=ddos_traffic_baselines
+hbase.zookeeper.quorum={{ zookeeper_servers }}
+hbase.zookeeper.client.port=2181
+
+##########################################
+############## Druid数据读取 ###############
+##########################################
+#读取druid时间范围方式，
+# 0：读取默认范围天数read.historical.days；
+# 1：指定时间范围
+read.druid.time.limit.type=0
+#07-05
+read.druid.min.time=1625414400000
+#07-08
+read.druid.max.time=1625673600000
+
+#Druid字段映射
+druid.attacktype.tcpsynflood=TCP SYN Flood
+druid.attacktype.udpflood=UDP Flood
+druid.attacktype.icmpflood=ICMP Flood
+druid.attacktype.dnsamplification=DNS Amplification
+druid.columnname.serverip=destination_ip
+druid.columnname.attacktype=attack_type
+druid.columnname.recvtime=__time
+druid.columnname.partition.num=partition_num
+baseline.metric.type=session_rate
+
+#Hbase字段映射
+hbase.baseline.generation.type.suffix=baseline_type
+hbase.baseline.zero.replace.value.suffix=default_value
+
+#数据情况
+#读取历史N天数据，最小值为3天（需要判断周期性）
+read.historical.days=7
+#历史数据汇聚粒度为10分钟
+historical.grad=10
+# 数据库Time格式
+time.format=yyyy-MM-dd HH:mm:ss
+
+##########################################
+############ Baseline生成参数 #############
+##########################################
+baseline.range.days=1
+baseline.function=KalmanFilter
+baseline.period.correlative.threshold=0.5
+baseline.historical.frequency.thread=0.2
+baseline.exception.percentile=0.99
+baseline.exception.fill.percentile=0.99
+baseline.rational.percentile=0.95
+
+#Kalman Filter
+baseline.kalman.q=0.1
+baseline.kalman.r=0.1
+baseline.kalman.p=8
+baseline.kalman.m=2
+
+monitor.frequency.bin.num=100
+
+##########################################
+################ 并发参数 #################
+##########################################
+#druid.read.batch.time.grad.hour=4
+thread.pool.num=20
+#druid分区字段partition_num的最大值为9999
+druid.partition.num.max=10000
+druid.connection.retry.time.max=10
+druid.connection.retry.sleep.time=1000
+
+
diff --git a/parcels/roles/init/druid/files/druid_segments-tsg-21.05.sql b/parcels/roles/init/druid/files/druid_segments-tsg-21.05.sql
deleted file mode 100644
index 8d005e0..0000000
--- a/parcels/roles/init/druid/files/druid_segments-tsg-21.05.sql
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- Navicat Premium Data Transfer
-
- Source Server         : 192.168.44.226
- Source Server Type    : MariaDB
- Source Server Version : 100503
- Source Host           : 192.168.44.226:3306
- Source Schema         : druid_33
-
- Target Server Type    : MariaDB
- Target Server Version : 100503
- File Encoding         : 65001
-
- Date: 02/04/2021 11:52:27
-*/
-
-SET NAMES utf8mb4;
-SET FOREIGN_KEY_CHECKS = 0;
-
--- ----------------------------
--- Table structure for druid_segments
--- ----------------------------
-DROP TABLE IF EXISTS `druid_segments`;
-CREATE TABLE `druid_segments`  (
-  `id` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
-  `dataSource` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NOT NULL,
-  `created_date` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
-  `start` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
-  `end` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
-  `partitioned` tinyint(1) NOT NULL,
-  `version` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
-  `used` tinyint(1) NOT NULL,
-  `payload` longblob NOT NULL,
-  PRIMARY KEY (`id`) USING BTREE,
-  INDEX `idx_druid_segments_used`(`used`) USING BTREE,
-  INDEX `idx_druid_segments_datasource_used_end`(`dataSource`, `used`, `end`) USING BTREE
-) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = Dynamic;
-
--- ----------------------------
--- Records of druid_segments
--- ----------------------------
-INSERT INTO `druid_segments` VALUES ('client_internal_ip_hot_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:39.273Z', 'client_internal_ip_hot_log', '2021-04-02T03:13:40.184Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:39.273Z', 1, 0x7B2264617461536F75726365223A22636C69656E745F696E7465726E616C5F69705F686F745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A33392E3237335A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F636C69656E745F696E7465726E616C5F69705F686F745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F33392E3237335A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22636F6D6D6F6E5F636C69656E745F69702C636F6D6D6F6E5F696E7465726E616C5F69702C636F6D6D6F6E5F6C345F70726F746F636F6C2C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323630372C226964656E746966696572223A22636C69656E745F696E7465726E616C5F69705F686F745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A33392E3237335A227D);
-INSERT INTO `druid_segments` VALUES ('proxy_event_hits_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:41.641Z', 'proxy_event_hits_log', '2021-04-02T03:13:42.617Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:41.641Z', 1, 0x7B2264617461536F75726365223A2270726F78795F6576656E745F686974735F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A34312E3634315A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F70726F78795F6576656E745F686974735F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F34312E3634315A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22636F756E7472792C6973702C7375625F616374696F6E2C6C6F636174696F6E2C616374696F6E2C656E7472616E63655F69642C686974732C706F6C6963795F69642C6332735F627974655F6E756D2C7332635F627974655F6E756D222C226D657472696373223A2269705F6F626A656374222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A333239332C226964656E746966696572223A2270726F78795F6576656E745F686974735F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A34312E3634315A227D);
-INSERT INTO `druid_segments` VALUES ('proxy_event_urls_hot_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:43.849Z', 'proxy_event_urls_hot_log', '2021-04-02T03:13:44.736Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:43.849Z', 1, 0x7B2264617461536F75726365223A2270726F78795F6576656E745F75726C735F686F745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A34332E3834395A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F70726F78795F6576656E745F75726C735F686F745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F34332E3834395A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A2275726C2C73657373696F6E5F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A313031372C226964656E746966696572223A2270726F78795F6576656E745F75726C735F686F745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A34332E3834395A227D);
-INSERT INTO `druid_segments` VALUES ('security_event_hits_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:46.392Z', 'security_event_hits_log', '2021-04-02T03:13:47.468Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:46.392Z', 1, 0x7B2264617461536F75726365223A2273656375726974795F6576656E745F686974735F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A34362E3339325A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F73656375726974795F6576656E745F686974735F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F34362E3339325A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A226973702C616374696F6E2C656E7472616E63655F69642C686974732C706F6C6963795F69642C6332735F627974655F6E756D2C7332635F627974655F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A313939332C226964656E746966696572223A2273656375726974795F6576656E745F686974735F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A34362E3339325A227D);
-INSERT INTO `druid_segments` VALUES ('security_event_urls_hot_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:48.458Z', 'security_event_urls_hot_log', '2021-04-02T03:13:49.325Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:48.458Z', 1, 0x7B2264617461536F75726365223A2273656375726974795F6576656E745F75726C735F686F745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A34382E3435385A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F73656375726974795F6576656E745F75726C735F686F745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F34382E3435385A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A2275726C2C73657373696F6E5F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A313031372C226964656E746966696572223A2273656375726974795F6576656E745F75726C735F686F745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A34382E3435385A227D);
-INSERT INTO `druid_segments` VALUES ('server_external_ip_hot_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:50.092Z', 'server_external_ip_hot_log', '2021-04-02T03:13:51.021Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:50.092Z', 1, 0x7B2264617461536F75726365223A227365727665725F65787465726E616C5F69705F686F745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A35302E3039325A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F7365727665725F65787465726E616C5F69705F686F745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F35302E3039325A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22636F6D6D6F6E5F7365727665725F69702C636F6D6D6F6E5F65787465726E616C5F69702C636F6D6D6F6E5F6C345F70726F746F636F6C2C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323630372C226964656E746966696572223A227365727665725F65787465726E616C5F69705F686F745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A35302E3039325A227D);
-INSERT INTO `druid_segments` VALUES ('sys_storage_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:52.202Z', 'sys_storage_log', '2021-04-02T03:13:53.057Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:52.202Z', 1, 0x7B2264617461536F75726365223A227379735F73746F726167655F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A35322E3230325A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F7379735F73746F726167655F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F35322E3230325A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A226C6F675F747970652C646174615F63656E7465722C6167677265676174655F73697A652C6C6173745F73746F726167652C6D61785F73697A652C757365645F73697A65222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A313938322C226964656E746966696572223A227379735F73746F726167655F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A35322E3230325A227D);
-INSERT INTO `druid_segments` VALUES ('top_client_ip_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:53.675Z', 'top_client_ip_log', '2021-04-02T03:13:54.681Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:53.675Z', 1, 0x7B2264617461536F75726365223A22746F705F636C69656E745F69705F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A35332E3637355A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F746F705F636C69656E745F69705F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F35332E3637355A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22736F757263652C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D2C6F726465725F6279222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323137372C226964656E746966696572223A22746F705F636C69656E745F69705F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A35332E3637355A227D);
-INSERT INTO `druid_segments` VALUES ('top_external_host_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:55.845Z', 'top_external_host_log', '2021-04-02T03:13:57.329Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:55.845Z', 1, 0x7B2264617461536F75726365223A22746F705F65787465726E616C5F686F73745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A35352E3834355A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F746F705F65787465726E616C5F686F73745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F35352E3834355A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A2264657374696E6174696F6E2C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D2C6F726465725F6279222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323139322C226964656E746966696572223A22746F705F65787465726E616C5F686F73745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A35352E3834355A227D);
-INSERT INTO `druid_segments` VALUES ('top_internal_host_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:58.433Z', 'top_internal_host_log', '2021-04-02T03:13:59.446Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:58.433Z', 1, 0x7B2264617461536F75726365223A22746F705F696E7465726E616C5F686F73745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A35382E3433335A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F746F705F696E7465726E616C5F686F73745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F35382E3433335A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22736F757263652C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D2C6F726465725F6279222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323137372C226964656E746966696572223A22746F705F696E7465726E616C5F686F73745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A35382E3433335A227D);
-INSERT INTO `druid_segments` VALUES ('top_server_ip_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:13:59.654Z', 'top_server_ip_log', '2021-04-02T03:14:00.955Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:13:59.654Z', 1, 0x7B2264617461536F75726365223A22746F705F7365727665725F69705F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31333A35392E3635345A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F746F705F7365727665725F69705F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31335F35392E3635345A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A2264657374696E6174696F6E2C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D2C6F726465725F6279222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323139322C226964656E746966696572223A22746F705F7365727665725F69705F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31333A35392E3635345A227D);
-INSERT INTO `druid_segments` VALUES ('top_urls_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:01.484Z', 'top_urls_log', '2021-04-02T03:14:02.269Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:01.484Z', 1, 0x7B2264617461536F75726365223A22746F705F75726C735F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A30312E3438345A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F746F705F75726C735F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F30312E3438345A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A2275726C2C73657373696F6E5F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A313031372C226964656E746966696572223A22746F705F75726C735F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A30312E3438345A227D);
-INSERT INTO `druid_segments` VALUES ('top_user_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:04.063Z', 'top_user_log', '2021-04-02T03:14:04.955Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:04.063Z', 1, 0x7B2264617461536F75726365223A22746F705F757365725F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A30342E3036335A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F746F705F757365725F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F30342E3036335A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22737562736372696265725F69642C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D2C6F726465725F6279222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323139382C226964656E746966696572223A22746F705F757365725F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A30342E3036335A227D);
-INSERT INTO `druid_segments` VALUES ('top_website_domain_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:06.100Z', 'top_website_domain_log', '2021-04-02T03:14:07.150Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:06.100Z', 1, 0x7B2264617461536F75726365223A22746F705F776562736974655F646F6D61696E5F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A30362E3130305A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F746F705F776562736974655F646F6D61696E5F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F30362E3130305A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22646F6D61696E2C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D2C6F726465725F6279222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323137372C226964656E746966696572223A22746F705F776562736974655F646F6D61696E5F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A30362E3130305A227D);
-INSERT INTO `druid_segments` VALUES ('traffic_metrics_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:08.462Z', 'traffic_metrics_log', '2021-04-02T03:14:09.342Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:08.462Z', 1, 0x7B2264617461536F75726365223A22747261666669635F6D6574726963735F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A30382E3436325A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F747261666669635F6D6574726963735F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F30382E3436325A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A226465766963655F69642C616C6C6F775F636F6E6E5F6E756D2C616C6C6F775F696E5F62797465732C616C6C6F775F696E5F7061636B6574732C616C6C6F775F6F75745F62797465732C616C6C6F775F6F75745F7061636B6574732C636C6F73655F636F6E6E5F6E756D2C64656661756C745F636F6E6E5F6E756D2C64656661756C745F696E5F62797465732C64656661756C745F696E5F7061636B6574732C64656661756C745F6F75745F62797465732C64656661756C745F6F75745F7061636B6574732C64656E795F636F6E6E5F6E756D2C64656E795F696E5F62797465732C64656E795F696E5F7061636B6574732C64656E795F6F75745F62797465732C64656E795F6F75745F7061636B6574732C65737461626C69736865645F636F6E6E5F6E756D2C696E746572636570745F636F6E6E5F6E756D2C696E746572636570745F696E5F62797465732C696E746572636570745F696E5F7061636B6574732C696E746572636570745F6F75745F62797465732C696E746572636570745F6F75745F7061636B6574732C6D6F6E69746F725F636F6E6E5F6E756D2C6D6F6E69746F725F696E5F62797465732C6D6F6E69746F725F696E5F7061636B6574732C6D6F6E69746F725F6F75745F62797465732C6D6F6E69746F725F6F75745F7061636B6574732C6E65775F636F6E6E5F6E756D2C746F74616C5F696E5F62797465732C746F74616C5F696E5F7061636B6574732C746F74616C5F6F75745F62797465732C656E7472616E63655F69642C746F74616C5F6F75745F7061636B6574732C70696E6E696E675F6E756D2C6E6F745F70696E6E696E675F6E756D2C6D617962655F70696E6E696E675F6E756D2C616C6572745F62797465732C696E735F62797465732C68696A6B5F62797465732C61645F7265666C656374696F6E5F62797465732C61645F666C6F6F645F62797465732C61645F63635F62797465732C696E7463705F6D6F6E5F6E756D2C696E7463705F616C6C6F775F6E756D2C696E7463705F64656E795F6E756D2C696E7463705F72646972745F6E756D2C696E7463705F7265706C5F6E756D2C696E7463705F68696A6B5F6E756D2C696E7463705F696E735F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A31313430362C226964656E746966696572223A22747261666669635F6D6574726963735F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A30382E3436325A227D);
-INSERT INTO `druid_segments` VALUES ('traffic_protocol_stat_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:09.706Z', 'traffic_protocol_stat_log', '2021-04-02T03:14:10.583Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:09.706Z', 1, 0x7B2264617461536F75726365223A22747261666669635F70726F746F636F6C5F737461745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A30392E3730365A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F747261666669635F70726F746F636F6C5F737461745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F30392E3730365A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A226973702C70726F746F636F6C5F69642C646174615F63656E7465722C6332735F706B745F6E756D2C656E7472616E63655F69642C73657373696F6E732C7332635F706B745F6E756D2C6332735F627974655F6E756D2C7332635F627974655F6E756D2C6332735F6970667261675F6E756D2C7332635F6970667261675F6E756D2C6332735F7463705F6C6F73746C656E2C7332635F7463705F6C6F73746C656E2C6332735F7463705F756E6F726465725F6E756D2C7332635F7463705F756E6F726465725F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A343032372C226964656E746966696572223A22747261666669635F70726F746F636F6C5F737461745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A30392E3730365A227D);
-INSERT INTO `druid_segments` VALUES ('traffic_summary_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:12.193Z', 'traffic_summary_log', '2021-04-02T03:14:13.233Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:12.193Z', 1, 0x7B2264617461536F75726365223A22747261666669635F73756D6D6172795F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A31322E3139335A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F747261666669635F73756D6D6172795F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F31322E3139335A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A226973702C736368656D615F747970652C646174615F63656E7465722C6332735F706B745F6E756D2C656E7472616E63655F69642C73657373696F6E732C7332635F706B745F6E756D2C6332735F627974655F6E756D2C7332635F627974655F6E756D2C6F6E655F73696465645F636F6E6E656374696F6E732C756E63617465676F72697A65645F62797465732C667261676D656E746174696F6E5F7061636B6574732C73657175656E63655F6761705F6C6F73732C756E6F726465725F7061636B657473222C226D657472696373223A2269705F6F626A656374222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A343133342C226964656E746966696572223A22747261666669635F73756D6D6172795F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A31322E3139335A227D);
-INSERT INTO `druid_segments` VALUES ('user_hot_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:14.350Z', 'user_hot_log', '2021-04-02T03:14:15.137Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:14.350Z', 1, 0x7B2264617461536F75726365223A22757365725F686F745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A31342E3335305A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F757365725F686F745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F31342E3335305A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22636F6D6D6F6E5F737562736372696265725F69642C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A313838332C226964656E746966696572223A22757365725F686F745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A31342E3335305A227D);
-INSERT INTO `druid_segments` VALUES ('website_domain_hot_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:16.425Z', 'website_domain_hot_log', '2021-04-02T03:14:17.174Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:16.425Z', 1, 0x7B2264617461536F75726365223A22776562736974655F646F6D61696E5F686F745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A31362E3432355A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F776562736974655F646F6D61696E5F686F745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F31362E3432355A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22646F6D61696E2C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A313834312C226964656E746966696572223A22776562736974655F646F6D61696E5F686F745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A31362E3432355A227D);
-
-SET FOREIGN_KEY_CHECKS = 1;
diff --git a/parcels/roles/init/druid/files/druid_segments-tsg3.0.sql b/parcels/roles/init/druid/files/druid_segments-tsg3.0.sql
index ceb9d8a..0b6ce8d 100644
--- a/parcels/roles/init/druid/files/druid_segments-tsg3.0.sql
+++ b/parcels/roles/init/druid/files/druid_segments-tsg3.0.sql
@@ -60,4 +60,6 @@ INSERT INTO `druid_segments` VALUES ('user_hot_log_3000-01-02T00:00:00.000Z_3000
 INSERT INTO `druid_segments` VALUES ('website_domain_hot_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-04-02T03:14:16.425Z', 'website_domain_hot_log', '2021-04-02T03:14:17.174Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-04-02T03:14:16.425Z', 1, 0x7B2264617461536F75726365223A22776562736974655F646F6D61696E5F686F745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30342D30325430333A31343A31362E3432355A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F776562736974655F646F6D61696E5F686F745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30342D30325430335F31345F31362E3432355A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A22646F6D61696E2C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A313834312C226964656E746966696572223A22776562736974655F646F6D61696E5F686F745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30342D30325430333A31343A31362E3432355A227D);
 INSERT INTO `druid_segments` VALUES ('traffic_app_stat_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-07-02T02:43:09.615Z', 'traffic_app_stat_log', '2021-07-02T02:43:10.572Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-07-02T02:43:09.615Z', 1, 0x7B2264617461536F75726365223A22747261666669635F6170705F737461745F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30372D30325430323A34333A30392E3631355A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F747261666669635F6170705F737461745F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30372D30325430325F34335F30392E3631355A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A226170705F6E616D652C6332735F627974655F6E756D2C6332735F706B745F6E756D2C7332635F627974655F6E756D2C7332635F706B745F6E756D2C73657373696F6E5F6E756D2C7375625F6170705F6E616D65222C226D657472696373223A22222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A323139352C226964656E746966696572223A22747261666669635F6170705F737461745F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30372D30325430323A34333A30392E3631355A227D);
 
+INSERT INTO `druid_segments`(`id`, `dataSource`, `created_date`, `start`, `end`, `partitioned`, `version`, `used`, `payload`) VALUES ('traffic_top_destination_ip_metrics_log_3000-01-02T00:00:00.000Z_3000-01-03T00:00:00.000Z_2021-08-11T10:21:56.486Z', 'traffic_top_destination_ip_metrics_log', '2021-08-11T10:21:57.448Z', '3000-01-02T00:00:00.000Z', '3000-01-03T00:00:00.000Z', 1, '2021-08-11T10:21:56.486Z', 1, 0x7B2264617461536F75726365223A22747261666669635F746F705F64657374696E6174696F6E5F69705F6D6574726963735F6C6F67222C22696E74657276616C223A22333030302D30312D30325430303A30303A30302E3030305A2F333030302D30312D30335430303A30303A30302E3030305A222C2276657273696F6E223A22323032312D30382D31315431303A32313A35362E3438365A222C226C6F616453706563223A7B2274797065223A2268646673222C2270617468223A22686466733A2F2F6E73312F64727569642F7365676D656E74732F747261666669635F746F705F64657374696E6174696F6E5F69705F6D6574726963735F6C6F672F3330303030313031543030303030302E3030305A5F3330303030313032543030303030302E3030305A2F323032312D30382D31315431305F32315F35362E3438365A2F305F696E6465782E7A6970227D2C2264696D656E73696F6E73223A2261747461636B5F747970652C636F6D6D6F6E5F646174615F63656E7465722C636F6D6D6F6E5F736C65645F69702C64657374696E6174696F6E5F69702C6269745F726174652C7061636B65745F726174652C706172746974696F6E5F6E756D2C73657373696F6E5F72617465222C226D657472696373223A2269705F6F626A656374222C22736861726453706563223A7B2274797065223A226E756D6265726564222C22706172746974696F6E4E756D223A302C22706172746974696F6E73223A307D2C2262696E61727956657273696F6E223A392C2273697A65223A333031302C226964656E746966696572223A22747261666669635F746F705F64657374696E6174696F6E5F69705F6D6574726963735F6C6F675F333030302D30312D30325430303A30303A30302E3030305A5F333030302D30312D30335430303A30303A30302E3030305A5F323032312D30382D31315431303A32313A35362E3438365A227D);
+
 SET FOREIGN_KEY_CHECKS = 1;
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/initData.sh b/parcels/roles/init/druid/files/druid_topology/initDruidData/initData.sh
deleted file mode 100755
index dd20185..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/initData.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/bash
-PWD=`pwd`
-task_name=`cat ${PWD}/tasks.txt`
-#overlord节点IP
-overlord_ip=$1
-
-
-for var in ${task_name[@]};
-do
-curl -X 'POST' -H 'Content-Type:application/json' -d @${var} http://${overlord_ip}:8081/druid/indexer/v1/task
-echo "'${var}' 数据初始化成功" 
-sleep 2
-done
-
-
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_client_internal_ip_hot_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_client_internal_ip_hot_log.json
deleted file mode 100644
index 0555054..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_client_internal_ip_hot_log.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"common_client_ip\":\" \",\"common_internal_ip\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"common_l4_protocol\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "client_internal_ip_hot_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "common_client_ip",
-				"type": "string"
-				},
-                                {
-                                "name": "common_internal_ip",
-                                "type": "string"
-                                },
-                                {
-                                "name": "common_l4_protocol",
-                                "type": "string"
-                                },
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_proxy_event_hits_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_proxy_event_hits_log.json
deleted file mode 100644
index 64d929a..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_proxy_event_hits_log.json
+++ /dev/null
@@ -1,85 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"country\":\" \",\"action\":1024,\"c2s_byte_num\":0,\"s2c_byte_num\":0,\"entrance_id\":0,\"policy_id\":0,\"location\":\" \",\"hits\":0,\"sub_action\":\" \",\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "proxy_event_hits_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": true
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "country",
-				"type": "string"
-				},
-                                {
-                                "name": "isp",
-                                "type": "string"
-                                },
-				{
-                                "name": "sub_action",
-                                "type": "string"
-                                },
-				{
-                                "name": "location",
-                                "type": "string"
-                                },
-				{
-                                "name": "action",
-                                "type": "long"
-                                },
-                                {
-                                "name": "entrance_id",
-                                "type": "long"
-                                },
-                                {
-                                "name": "hits",
-                                "type": "long"
-                                },
-                                {
-                                "name": "policy_id",
-                                "type": "long"
-                                },
-                                {
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		},
-		"metricsSpec": [
-                {
-                        "type": "HLLSketchBuild",
-                        "name": "ip_object",
-                        "fieldName": "ips"
-                }       
-                ]
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_proxy_event_urls_hot_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_proxy_event_urls_hot_log.json
deleted file mode 100644
index 7dfdd97..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_proxy_event_urls_hot_log.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"url\":\" \",\"session_num\":0,\"device_id\":\" \",\"ips\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "proxy_event_urls_hot_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "url",
-				"type": "string"
-				},
-				{
-                                "name": "session_num",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_security_event_hits_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_security_event_hits_log.json
deleted file mode 100644
index e503cba..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_security_event_hits_log.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"country\":\" \",\"action\":1024,\"c2s_byte_num\":0,\"s2c_byte_num\":0,\"entrance_id\":0,\"policy_id\":0,\"location\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "security_event_hits_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "isp",
-				"type": "string"
-				},
-				{
-                                "name": "action",
-                                "type": "long"
-                                },
-                                {
-                                "name": "entrance_id",
-                                "type": "long"
-                                },
-                                {
-                                "name": "hits",
-                                "type": "long"
-                                },
-                                {
-                                "name": "policy_id",
-                                "type": "long"
-                                },
-                                {
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_security_event_urls_hot_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_security_event_urls_hot_log.json
deleted file mode 100644
index 20fda07..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_security_event_urls_hot_log.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"url\":\" \",\"session_num\":0,\"device_id\":\" \",\"ips\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "security_event_urls_hot_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "url",
-				"type": "string"
-				},
-				{
-                                "name": "session_num",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_server_external_ip_hot_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_server_external_ip_hot_log.json
deleted file mode 100644
index e79b15d..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_server_external_ip_hot_log.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"common_server_ip\":\" \",\"common_external_ip\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"common_l4_protocol\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "server_external_ip_hot_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "common_server_ip",
-				"type": "string"
-				},
-                                {
-                                "name": "common_external_ip",
-                                "type": "string"
-                                },
-                                {
-                                "name": "common_l4_protocol",
-                                "type": "string"
-                                },
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_sys_storage_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_sys_storage_log.json
deleted file mode 100644
index 8b88307..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_sys_storage_log.json
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"log_type\":\" \",\"data_center\":\" \",\"aggregate_size\":0,\"first_storage\":0,\"max_size\":0,\"stored_days\":0,\"used_size\":0,\"location\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "sys_storage_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "log_type",
-				"type": "string"
-				},
-                                {
-                                "name": "data_center",
-                                "type": "string"
-                                },
-				{
-                                "name": "aggregate_size",
-                                "type": "long"
-                                },
-				{
-                                "name": "last_storage",
-                                "type": "long"
-                                },
-				{
-                                "name": "max_size",
-                                "type": "long"
-                                },
-                                {
-                                "name": "used_size",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_client_ip_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_client_ip_log.json
deleted file mode 100644
index 86027b3..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_client_ip_log.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"source\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "top_client_ip_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "source",
-				"type": "string"
-				},
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "order_by",
-                                "type": "string"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_external_host_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_external_host_log.json
deleted file mode 100644
index fb54545..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_external_host_log.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"destination\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "top_external_host_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "destination",
-				"type": "string"
-				},
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "order_by",
-                                "type": "string"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_internal_host_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_internal_host_log.json
deleted file mode 100644
index 8678bbd..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_internal_host_log.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"source\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "top_internal_host_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "source",
-				"type": "string"
-				},
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "order_by",
-                                "type": "string"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_server_ip_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_server_ip_log.json
deleted file mode 100644
index 4358106..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_server_ip_log.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"destination\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "top_server_ip_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "destination",
-				"type": "string"
-				},
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "order_by",
-                                "type": "string"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_urls_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_urls_log.json
deleted file mode 100644
index 9a9c7d2..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_urls_log.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"url\":\" \",\"session_num\":0,\"device_id\":\" \",\"ips\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "top_urls_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "url",
-				"type": "string"
-				},
-				{
-                                "name": "session_num",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_user_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_user_log.json
deleted file mode 100644
index 61aaa46..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_user_log.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"subscriber_id\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "top_user_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "subscriber_id",
-				"type": "string"
-				},
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "order_by",
-                                "type": "string"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_website_domain_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_website_domain_log.json
deleted file mode 100644
index 828a7c6..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_top_website_domain_log.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"domain\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "top_website_domain_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "domain",
-				"type": "string"
-				},
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "order_by",
-                                "type": "string"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_app_stat_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_app_stat_log.json
deleted file mode 100644
index c4e2a64..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_app_stat_log.json
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"app_name\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"sub_app_name\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "traffic_app_stat_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "app_name",
-				"type": "string"
-				},
-				{
-				"name": "c2s_byte_num",
-				"type": "long"
-				},
-				{
-				"name": "c2s_pkt_num",
-				"type": "long"
-				},
-				{
-				"name": "s2c_byte_num",
-				"type": "long"
-				},
-				{
-				"name": "s2c_pkt_num",
-				"type": "long"
-				},
-				{
-				"name": "session_num",
-				"type": "long"
-				},
-				{
-				"name": "sub_app_name",
-				"type": "string"
-				}
-			]
-			}
-		}
-		}
-	}
-  }
-}
-
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_metrics_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_metrics_log.json
deleted file mode 100644
index b530649..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_metrics_log.json
+++ /dev/null
@@ -1,88 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"device_id\":\" \",\"allow_conn_num\":0,\"allow_in_bytes\":0,\"allow_in_packets\":0,\"allow_out_bytes\":0,\"allow_out_packets\":0,\"close_conn_num\":0,\"default_conn_num\":0,\"default_in_bytes\":0,\"default_in_packets\":0,\"default_out_bytes\":0,\"default_out_packets\":0,\"deny_conn_num\":0,\"deny_in_bytes\":0,\"deny_in_packets\":0,\"deny_out_bytes\":0,\"deny_out_packets\":0,\"established_conn_num\":0,\"intercept_conn_num\":0,\"intercept_in_bytes\":0,\"intercept_in_packets\":0,\"intercept_out_bytes\":0,\"intercept_out_packets\":0,\"monitor_conn_num\":0,\"monitor_in_bytes\":0,\"monitor_in_packets\":0,\"monitor_out_bytes\":0,\"monitor_out_packets\":0,\"new_conn_num\":0,\"total_in_bytes\":0,\"total_in_packets\":0,\"total_out_bytes\":0,\"total_out_packets\":0,\"entrance_id\":0,\"pinning_num\":0,\"not_pinning_num\":0,\"maybe_pinning_num\":0,\"alert_bytes\":0,\"ins_bytes\":0,\"hijk_bytes\":0,\"reflection_bytes\":0,\"flood_bytes\":0,\"intcp_mon_num\":0,\"intcp_allow_num\":0,\"intcp_deny_num\":0,\"intcp_rdirt_num\":0,\"intcp_repl_num\":0,\"intcp_hijk_num\":0,\"intcp_ins_num\":0,\"ad_reflection_bytes\":0,\"ad_flood_bytes\":0,\"ad_cc_bytes\":0}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "traffic_metrics_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{"name": "device_id","type": "string"},
-				{"name": "allow_conn_num","type": "long"},
-				{"name": "allow_in_bytes","type": "long"},
-				{"name": "allow_in_packets","type": "long"},
-				{"name": "allow_out_bytes","type": "long"},
-				{"name": "allow_out_packets","type": "long"},
-				{"name": "close_conn_num","type": "long"},
-				{"name": "default_conn_num","type": "long"},
-				{"name": "default_in_bytes","type": "long"},
-				{"name": "default_in_packets","type": "long"},
-				{"name": "default_out_bytes","type": "long"},
-				{"name": "default_out_packets","type": "long"},
-				{"name": "deny_conn_num","type": "long"},
-				{"name": "deny_in_bytes","type": "long"},
-				{"name": "deny_in_packets","type": "long"},
-				{"name": "deny_out_bytes","type": "long"},
-				{"name": "deny_out_packets","type": "long"},
-				{"name": "established_conn_num","type": "long"},
-				{"name": "intercept_conn_num","type": "long"},
-				{"name": "intercept_in_bytes","type": "long"},
-				{"name": "intercept_in_packets","type": "long"},
-				{"name": "intercept_out_bytes","type": "long"},
-				{"name": "intercept_out_packets","type": "long"},
-				{"name": "monitor_conn_num","type": "long"},
-				{"name": "monitor_in_bytes","type": "long"},
-				{"name": "monitor_in_packets","type": "long"},
-				{"name": "monitor_out_bytes","type": "long"},
-				{"name": "monitor_out_packets","type": "long"},
-				{"name": "new_conn_num","type": "long"},
-				{"name": "total_in_bytes","type": "long"},
-				{"name": "total_in_packets","type": "long"},
-				{"name": "total_out_bytes","type": "long"},
-                                {"name": "entrance_id","type": "long"},
-				{"name": "total_out_packets","type": "long"},
-                                {"name": "pinning_num","type": "long"},
-                                {"name": "not_pinning_num","type": "long"},
-                                {"name": "maybe_pinning_num","type": "long"},
-                                {"name": "alert_bytes","type": "long"},
-                                {"name": "ins_bytes","type": "long"},
-                                {"name": "hijk_bytes","type": "long"},
-                                {"name": "ad_reflection_bytes","type": "long"},
-                                {"name": "ad_flood_bytes","type": "long"},
-				{"name": "ad_cc_bytes","type": "long"},
-                                {"name": "intcp_mon_num","type": "long"},
-                                {"name": "intcp_allow_num","type": "long"},
-                                {"name": "intcp_deny_num","type": "long"},
-                                {"name": "intcp_rdirt_num","type": "long"},
-                                {"name": "intcp_repl_num","type": "long"},
-                                {"name": "intcp_hijk_num","type": "long"},
-                                {"name": "intcp_ins_num","type": "long"}
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_protocol_stat_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_protocol_stat_log.json
deleted file mode 100644
index aa56c33..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_protocol_stat_log.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-	   "data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"protocol_id\":\" \",\"country\":\" \",\"one_sided_connections\":1024,\"sequence_gap_loss\":0,\"s2c_byte_num\":0,\"entrance_id\":0,\"fragmentation_packets\":0,\"location\":\" \",\"uncategorized_bytes\":0,\"unorder_packets\":0,\"sub_action\":\" \",\"ips\":\" \",\"isp\":\" \",\"schema_type\":\" \",\"data_center\":\" \",\"s2c_pkt_num\":0,\"s2c_pkt_num\":0,\"c2s_ipfrag_num\":0,\"s2c_ipfrag_num\":0,\"c2s_tcp_lostlen\":0,\"s2c_tcp_lostlen\":0,\"c2s_tcp_unorder_num\":0,\"s2c_tcp_unorder_num\":0}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-    "dataSchema": {
-      "dataSource": "traffic_protocol_stat_log",
-      "granularitySpec": {
-        "type": "uniform",
-        "segmentGranularity": "DAY",
-        "queryGranularity": "NONE",
-        "rollup": true
-      },
-	  "parser": {
-      "type": "string",
-      "parseSpec": {
-        "format": "json",
-        "timestampSpec": {
-          "column": "test_time",
-          "format": "iso"
-        },
-        "dimensionsSpec": {
-          "dimensions": [
-          {"name": "isp","type": "string"},
-          {"name": "protocol_id","type": "string"},
-          {"name": "data_center","type": "string"},
-          {"name": "c2s_pkt_num","type": "long"},
-          {"name": "entrance_id","type": "long"},
-          {"name": "sessions","type": "long"},
-          {"name": "s2c_pkt_num","type": "long"},
-          {"name": "c2s_byte_num","type": "long"},
-          {"name": "s2c_byte_num","type": "long"},
-          {"name": "c2s_ipfrag_num","type": "long"},
-          {"name": "s2c_ipfrag_num","type": "long"},
-          {"name": "c2s_tcp_lostlen","type": "long"},
-	  {"name": "s2c_tcp_lostlen","type": "long"},
-          {"name": "c2s_tcp_unorder_num","type": "long"},
-          {"name": "s2c_tcp_unorder_num","type": "long"}
-          ]
-        }
-      }
-    }, 
-    "metricsSpec": []
-    }
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_summary_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_summary_log.json
deleted file mode 100644
index 582beb4..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_traffic_summary_log.json
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-	   "data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"country\":\" \",\"one_sided_connections\":1024,\"sequence_gap_loss\":0,\"s2c_byte_num\":0,\"entrance_id\":0,\"fragmentation_packets\":0,\"location\":\" \",\"uncategorized_bytes\":0,\"unorder_packets\":0,\"sub_action\":\" \",\"ips\":\" \",\"isp\":\" \",\"schema_type\":\" \",\"data_center\":\" \",\"s2c_pkt_num\":0,\"s2c_pkt_num\":0,\"c2s_ipfrag_num\":0,\"s2c_ipfrag_num\":0,\"c2s_tcp_lostlen\":0,\"s2c_tcp_lostlen\":0,\"c2s_tcp_unorder_num\":0,\"s2c_tcp_unorder_num\":0}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-  "dataSchema": {
-    "dataSource": "traffic_summary_log",
-    "granularitySpec": {
-      "type": "uniform",
-      "segmentGranularity": "DAY",
-      "queryGranularity": "NONE",
-      "rollup": true
-    },
-    "parser": {
-      "type": "string",
-      "parseSpec": {
-        "format": "json",
-        "timestampSpec": {
-          "column": "test_time",
-          "format": "iso"
-        },
-        "dimensionsSpec": {
-          "dimensions": [
-          {"name": "isp","type": "string"},
-          {"name": "schema_type","type": "string"},
-          {"name": "data_center","type": "string"},
-          {"name": "c2s_pkt_num","type": "long"},
-          {"name": "entrance_id","type": "long"},
-          {"name": "sessions","type": "long"},
-          {"name": "s2c_pkt_num","type": "long"},
-          {"name": "c2s_byte_num","type": "long"},
-          {"name": "s2c_byte_num","type": "long"},
-          {"name": "one_sided_connections","type": "long"},
-          {"name": "uncategorized_bytes","type": "long"},
-          {"name": "fragmentation_packets","type": "long"},
-		  {"name": "sequence_gap_loss","type": "long"},
-          {"name": "unorder_packets","type": "long"}
-          ]
-        }
-      }
-    },
-	"metricsSpec": [{"type": "HLLSketchBuild","name": "ip_object","fieldName": "ips"}]
-  }
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_user_hot_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_user_hot_log.json
deleted file mode 100644
index 9f99cd3..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_user_hot_log.json
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"common_subscriber_id\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "user_hot_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "common_subscriber_id",
-				"type": "string"
-				},
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                }
-			]
-			}
-		}
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_website_domain_hot_log.json b/parcels/roles/init/druid/files/druid_topology/initDruidData/init_website_domain_hot_log.json
deleted file mode 100644
index e9df8bd..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/init_website_domain_hot_log.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "type": "index",
-  "spec":{
-	"ioConfig": {
-		"type": "index",
-		"firehose": {
-		"type": "inline",
-		"data": "{\"test_time\":\"3000-01-01T00:00:00.000\",\"domain\":\" \",\"c2s_byte_num\":0,\"c2s_pkt_num\":0,\"s2c_byte_num\":0,\"s2c_pkt_num\":0,\"session_num\":0,\"order_by\":\" \",\"hits\":0,\"sub_action\":\" \",\"intercept_state\":0,\"pinningst\":0,\"ips\":\" \",\"isp\":\" \"}"
-		}
-	},
-	"tuningConfig": {
-		"type": "index"
-	},
-	"dataSchema": {
-		"dataSource": "website_domain_hot_log",
-		"granularitySpec": {
-		"type": "uniform",
-		"segmentGranularity": "DAY",
-		"queryGranularity": "NONE",
-		"rollup": false
-		},
-		"parser": {
-		"type": "string",
-		"parseSpec": {
-			"format": "json",
-			"timestampSpec": {
-			"column": "test_time",
-			"format": "iso"
-			},
-			"dimensionsSpec": {
-			"dimensions": [
-				{
-				"name": "domain",
-				"type": "string"
-				},
-				{
-                                "name": "c2s_byte_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "c2s_pkt_num",
-                                "type": "long"
-                                },
-				{
-                                "name": "s2c_byte_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "s2c_pkt_num",
-                                "type": "long"
-                                },
-                                {
-                                "name": "session_num",
-                                "type": "long"
-                                }]}
-		},
-		"metricsSpec": [{"type": "HLLSketchBuild","name": "ip_object","fieldName": "ips"}]
-		}
-	}
-  }
-}
diff --git a/parcels/roles/init/druid/files/druid_topology/initDruidData/tasks.txt b/parcels/roles/init/druid/files/druid_topology/initDruidData/tasks.txt
deleted file mode 100644
index 791a829..0000000
--- a/parcels/roles/init/druid/files/druid_topology/initDruidData/tasks.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-init_client_internal_ip_hot_log.json
-init_proxy_event_hits_log.json
-init_proxy_event_urls_hot_log.json
-init_security_event_hits_log.json
-init_security_event_urls_hot_log.json
-init_server_external_ip_hot_log.json
-init_sys_storage_log.json
-init_top_client_ip_log.json
-init_top_external_host_log.json
-init_top_internal_host_log.json
-init_top_server_ip_log.json
-init_top_urls_log.json
-init_top_user_log.json
-init_top_website_domain_log.json
-init_traffic_metrics_log.json
-init_traffic_protocol_stat_log.json
-init_traffic_summary_log.json
-init_user_hot_log.json
-init_website_domain_hot_log.json
-init_traffic_app_stat_log.json
diff --git a/parcels/roles/init/druid/files/druid_topology/rule/common_task.txt b/parcels/roles/init/druid/files/druid_topology/rule/common_task.txt
index fe803ab..7578479 100644
--- a/parcels/roles/init/druid/files/druid_topology/rule/common_task.txt
+++ b/parcels/roles/init/druid/files/druid_topology/rule/common_task.txt
@@ -11,3 +11,4 @@ top_urls_log
 traffic_protocol_stat_log
 traffic_metrics_log
 sys_storage_log
+traffic_top_destination_ip_metrics_log
diff --git a/parcels/roles/init/druid/files/druid_topology/tasks/traffic_summary_log.json b/parcels/roles/init/druid/files/druid_topology/tasks/traffic_summary_log.json
index 9235705..7bdfa91 100644
--- a/parcels/roles/init/druid/files/druid_topology/tasks/traffic_summary_log.json
+++ b/parcels/roles/init/druid/files/druid_topology/tasks/traffic_summary_log.json
@@ -46,7 +46,7 @@
         {"type": "expression","name": "entrance_id","expression": "common_entrance_id"},
         {"type": "expression","name": "schema_type","expression": "common_schema_type"},
 	{"type": "expression", "name": "one_sided_connections", "expression": "if(common_stream_dir!=3,common_sessions,0)"},
-        {"type": "expression", "name": "uncategorized_bytes", "expression": "if(array_ordinal(string_to_array(common_protocol_label,'/'),1)=='UNCATEGORIZED',\"common_c2s_byte_num\"+\"common_s2c_byte_num\",0)"},
+        {"type": "expression", "name": "uncategorized_bytes", "expression": "if(\"common_l7_protocol\"=='UNCATEGORIZED',\"common_c2s_byte_num\"+\"common_s2c_byte_num\",0)"},
         {"type": "expression","name": "fragmentation_packets","expression": "\"common_c2s_ipfrag_num\"+\"common_s2c_ipfrag_num\""},
         {"type": "expression","name": "sequence_gap_loss","expression": "\"common_c2s_tcp_lostlen\"+\"common_s2c_tcp_lostlen\""},
         {"type": "expression","name": "unorder_packets","expression": "\"common_c2s_tcp_unorder_num\"+\"common_s2c_tcp_unorder_num\""}
diff --git a/parcels/roles/init/druid/files/druid_topology/tasks/traffic_top_destination_ip_metrics_log.json b/parcels/roles/init/druid/files/druid_topology/tasks/traffic_top_destination_ip_metrics_log.json
new file mode 100644
index 0000000..971fdf1
--- /dev/null
+++ b/parcels/roles/init/druid/files/druid_topology/tasks/traffic_top_destination_ip_metrics_log.json
@@ -0,0 +1,55 @@
+{
+  "type": "kafka",
+  "dataSchema": {
+    "dataSource": "traffic_top_destination_ip_metrics_log",
+    "parser": {
+      "type": "string",
+      "parseSpec": {
+        "format": "json",
+        "timestampSpec": {
+          "column": "sketch_start_time",
+          "format": "posix"
+        },
+        "dimensionsSpec": {
+          "dimensions": [
+	  "common_sled_ip",
+	  "destination_ip",
+	  "common_data_center",
+	  "attack_type",
+	  { "type": "long", "name": "partition_num" }
+          ]
+        }
+      }
+    },
+    "metricsSpec" : [
+	{ "type" : "longSum", "name" : "session_rate","fieldName" : "session_rate"},
+        { "type" : "longSum", "name" : "packet_rate", "fieldName" : "packet_rate" },
+        { "type" : "longSum", "name" : "bit_rate", "fieldName" : "bit_rate" },
+	{ "type" : "HLLSketchBuild", "name" : "ip_object", "fieldName" : "common_client_ip" }
+  ],
+    "granularitySpec": {
+      "type": "uniform",
+      "segmentGranularity": "DAY",
+      "queryGranularity": {"type": "period", "period": "PT10M", "timeZone": "Asia/Hong_Kong"},
+      "rollup": true
+    },
+    "transformSpec" :{
+      "transforms":[]
+    }
+  },
+  "tuningConfig": {
+    "type": "kafka",
+    "resetOffsetAutomatically": true,
+    "reportParseExceptions": false
+  },
+  "ioConfig": {
+    "topic": "TRAFFIC-TOP-DESTINATION-IP-METRICS-LOG",
+    "taskCount": 1,
+    "replicas": 1,
+    "taskDuration": "PT1H",
+    "completionTimeout": "PT30M",
+    "consumerProperties": {
+      "bootstrap.servers": "kafkabootstrap"
+    }
+  }
+}
diff --git a/parcels/roles/init/druid/files/druid_topology/topology_list.txt b/parcels/roles/init/druid/files/druid_topology/topology_list.txt
index d68b955..0f3b791 100644
--- a/parcels/roles/init/druid/files/druid_topology/topology_list.txt
+++ b/parcels/roles/init/druid/files/druid_topology/topology_list.txt
@@ -18,4 +18,4 @@ traffic_app_stat_log.json
 traffic_metrics_log.json
 traffic_protocol_stat_log.json
 traffic_summary_log.json
-
+traffic_top_destination_ip_metrics_log.json
diff --git a/parcels/roles/init/druid/files/segments.zip b/parcels/roles/init/druid/files/segments.zip
index c1e4c71..a514bf2 100644
Binary files a/parcels/roles/init/druid/files/segments.zip and b/parcels/roles/init/druid/files/segments.zip differ
diff --git a/parcels/roles/init/druid/files/segments/client_internal_ip_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_39.273Z/0_index.zip b/parcels/roles/init/druid/files/segments/client_internal_ip_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_39.273Z/0_index.zip
deleted file mode 100644
index 4879b1a..0000000
Binary files a/parcels/roles/init/druid/files/segments/client_internal_ip_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_39.273Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/proxy_event_hits_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_41.641Z/0_index.zip b/parcels/roles/init/druid/files/segments/proxy_event_hits_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_41.641Z/0_index.zip
deleted file mode 100644
index ae5b39a..0000000
Binary files a/parcels/roles/init/druid/files/segments/proxy_event_hits_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_41.641Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/proxy_event_urls_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_43.849Z/0_index.zip b/parcels/roles/init/druid/files/segments/proxy_event_urls_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_43.849Z/0_index.zip
deleted file mode 100644
index aa6b76b..0000000
Binary files a/parcels/roles/init/druid/files/segments/proxy_event_urls_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_43.849Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/security_event_hits_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_46.392Z/0_index.zip b/parcels/roles/init/druid/files/segments/security_event_hits_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_46.392Z/0_index.zip
deleted file mode 100644
index 7e3f6ba..0000000
Binary files a/parcels/roles/init/druid/files/segments/security_event_hits_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_46.392Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/security_event_urls_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_48.458Z/0_index.zip b/parcels/roles/init/druid/files/segments/security_event_urls_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_48.458Z/0_index.zip
deleted file mode 100644
index b7f6a02..0000000
Binary files a/parcels/roles/init/druid/files/segments/security_event_urls_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_48.458Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/server_external_ip_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_50.092Z/0_index.zip b/parcels/roles/init/druid/files/segments/server_external_ip_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_50.092Z/0_index.zip
deleted file mode 100644
index 3ca0642..0000000
Binary files a/parcels/roles/init/druid/files/segments/server_external_ip_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_50.092Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/sys_storage_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_52.202Z/0_index.zip b/parcels/roles/init/druid/files/segments/sys_storage_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_52.202Z/0_index.zip
deleted file mode 100644
index 05c9179..0000000
Binary files a/parcels/roles/init/druid/files/segments/sys_storage_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_52.202Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/top_client_ip_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_53.675Z/0_index.zip b/parcels/roles/init/druid/files/segments/top_client_ip_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_53.675Z/0_index.zip
deleted file mode 100644
index 8b5b27a..0000000
Binary files a/parcels/roles/init/druid/files/segments/top_client_ip_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_53.675Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/top_external_host_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_55.845Z/0_index.zip b/parcels/roles/init/druid/files/segments/top_external_host_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_55.845Z/0_index.zip
deleted file mode 100644
index 3bc1a01..0000000
Binary files a/parcels/roles/init/druid/files/segments/top_external_host_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_55.845Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/top_internal_host_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_58.433Z/0_index.zip b/parcels/roles/init/druid/files/segments/top_internal_host_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_58.433Z/0_index.zip
deleted file mode 100644
index 996bec3..0000000
Binary files a/parcels/roles/init/druid/files/segments/top_internal_host_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_58.433Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/top_server_ip_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_59.654Z/0_index.zip b/parcels/roles/init/druid/files/segments/top_server_ip_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_59.654Z/0_index.zip
deleted file mode 100644
index cf4648e..0000000
Binary files a/parcels/roles/init/druid/files/segments/top_server_ip_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_13_59.654Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/top_urls_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_01.484Z/0_index.zip b/parcels/roles/init/druid/files/segments/top_urls_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_01.484Z/0_index.zip
deleted file mode 100644
index b402447..0000000
Binary files a/parcels/roles/init/druid/files/segments/top_urls_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_01.484Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/top_user_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_04.063Z/0_index.zip b/parcels/roles/init/druid/files/segments/top_user_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_04.063Z/0_index.zip
deleted file mode 100644
index 84fb3ed..0000000
Binary files a/parcels/roles/init/druid/files/segments/top_user_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_04.063Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/top_website_domain_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_06.100Z/0_index.zip b/parcels/roles/init/druid/files/segments/top_website_domain_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_06.100Z/0_index.zip
deleted file mode 100644
index 9221dd2..0000000
Binary files a/parcels/roles/init/druid/files/segments/top_website_domain_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_06.100Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/traffic_app_stat_log/30000101T000000.000Z_30000102T000000.000Z/2021-07-02T02_43_09.615Z/0_index.zip b/parcels/roles/init/druid/files/segments/traffic_app_stat_log/30000101T000000.000Z_30000102T000000.000Z/2021-07-02T02_43_09.615Z/0_index.zip
deleted file mode 100644
index 63c1bf7..0000000
Binary files a/parcels/roles/init/druid/files/segments/traffic_app_stat_log/30000101T000000.000Z_30000102T000000.000Z/2021-07-02T02_43_09.615Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/traffic_metrics_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_08.462Z/0_index.zip b/parcels/roles/init/druid/files/segments/traffic_metrics_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_08.462Z/0_index.zip
deleted file mode 100644
index 561be3a..0000000
Binary files a/parcels/roles/init/druid/files/segments/traffic_metrics_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_08.462Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/traffic_protocol_stat_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_09.706Z/0_index.zip b/parcels/roles/init/druid/files/segments/traffic_protocol_stat_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_09.706Z/0_index.zip
deleted file mode 100644
index d2917f1..0000000
Binary files a/parcels/roles/init/druid/files/segments/traffic_protocol_stat_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_09.706Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/traffic_summary_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_12.193Z/0_index.zip b/parcels/roles/init/druid/files/segments/traffic_summary_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_12.193Z/0_index.zip
deleted file mode 100644
index 58cbd03..0000000
Binary files a/parcels/roles/init/druid/files/segments/traffic_summary_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_12.193Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/user_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_14.350Z/0_index.zip b/parcels/roles/init/druid/files/segments/user_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_14.350Z/0_index.zip
deleted file mode 100644
index 67b1b2e..0000000
Binary files a/parcels/roles/init/druid/files/segments/user_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_14.350Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/files/segments/website_domain_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_16.425Z/0_index.zip b/parcels/roles/init/druid/files/segments/website_domain_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_16.425Z/0_index.zip
deleted file mode 100644
index 8c7e660..0000000
Binary files a/parcels/roles/init/druid/files/segments/website_domain_hot_log/30000101T000000.000Z_30000102T000000.000Z/2021-04-02T03_14_16.425Z/0_index.zip and /dev/null differ
diff --git a/parcels/roles/init/druid/templates/ingestionTask.sh.j2 b/parcels/roles/init/druid/templates/ingestionTask.sh.j2
index 6fa0866..27117d0 100644
--- a/parcels/roles/init/druid/templates/ingestionTask.sh.j2
+++ b/parcels/roles/init/druid/templates/ingestionTask.sh.j2
@@ -3,7 +3,7 @@
 #note:该脚本应该和任务列表文件tasks.txt,*.json文件存放于同一目录下
 source /etc/profile
 task_name=`cat topology_list.txt`
-kafka_host={{ consumer_kafka_servers }}
+kafka_host={{ kafka_source_servers }}
 druid_host={{ groups.druid[0] }}
 
 curl -i -XGET 'http://'$druid_host':8081/druid/indexer/v1/leader'
diff --git a/parcels/roles/init/flink/tasks/main.yml b/parcels/roles/init/flink/tasks/main.yml
new file mode 100644
index 0000000..9d04154
--- /dev/null
+++ b/parcels/roles/init/flink/tasks/main.yml
@@ -0,0 +1,117 @@
+- name: get zookeeper_servers to ansible variable
+  set_fact: zookeeper_servers="{{groups.zookeeper[0]}}:2181,{{groups.zookeeper[1]}}:2181,{{groups.zookeeper[2]}}:2181"
+  when: '(groups.zookeeper|length) == 3'
+  
+- name: get zookeeper_servers to ansible variable
+  set_fact: zookeeper_servers="{{groups.zookeeper[0]}}:2181,{{groups.zookeeper[1]}}:2181,{{groups.zookeeper[2]}}:2181,{{groups.zookeeper[3]}}:2181,{{groups.zookeeper[4]}}:2181"
+  when: '(groups.zookeeper|length) >= 5'
+
+- name: master_ip to ansible variable
+  set_fact: master_ip="{{groups.flink[0]}}"
+
+#复制任务到目标服务器
+- name: copy topology path:{{ install_path }}
+  copy: 
+    src: '{{ package_path }}/topology'
+    dest: '{{ install_path }}/'
+    force: true
+    backup: yes
+  #其他服务器上的包就当备份
+  #delegate_to: "{{ master_ip }}"
+
+- name: copy topology config to files
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    force: true
+    backup: false
+  with_items:
+    - { src: 'RADIUS-RELATIONSHIP-HBASE.j2', dest: '{{ install_path }}/topology/accountHbase/config/RADIUS-RELATIONSHIP-HBASE' }
+    - { src: 'ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG' }
+    - { src: 'CONNECTION-RECORD-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/CONNECTION-RECORD-COMPLETED-LOG' }
+    - { src: 'GTPC-RECORD-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/GTPC-RECORD-COMPLETED-LOG' }
+    - { src: 'LIVE-SESSION-RECORD-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/LIVE-SESSION-RECORD-COMPLETED-LOG' }
+    - { src: 'PROXY-EVENT-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/PROXY-EVENT-COMPLETED-LOG' }
+    - { src: 'RADIUS-RECORD-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/RADIUS-RECORD-COMPLETED-LOG' }
+    - { src: 'SECURITY-EVENT-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/SECURITY-EVENT-COMPLETED-LOG' }
+    - { src: 'SYS-PACKET-CAPTURE-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/SYS-PACKET-CAPTURE-COMPLETED-LOG' }
+    - { src: 'TRANSACTION-RECORD-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/TRANSACTION-RECORD-COMPLETED-LOG' }
+    - { src: 'VOIP-RECORD-COMPLETED-LOG.j2', dest: '{{ install_path }}/topology/completion/config/VOIP-RECORD-COMPLETED-LOG' }
+    - { src: 'DOS-DETECTION-APPLICATION.j2', dest: '{{ install_path }}/topology/dos-detection/DOS-DETECTION-APPLICATION' }
+    - { src: 'LIVE-CHARTS_CONNECTION-RECORD-LOG.j2', dest: '{{ install_path }}/topology/livecharts/config/LIVE-CHARTS_CONNECTION-RECORD-LOG' }
+    - { src: 'LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2', dest: '{{ install_path }}/topology/livecharts/config/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG' }
+    - { src: 'RADIUS-ON-OFF.j2', dest: '{{ install_path }}/topology/radiusOnOff/config/RADIUS-ON-OFF' }
+    - { src: 'VOIP-RELATION.j2', dest: '{{ install_path }}/topology/voipRelation/config/VOIP-RELATION' }
+
+- name: stop flink subscriberHbase topology
+  shell: cd {{ install_path }}/topology/accountHbase && chmod +x *.sh && ./stop.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: stop flink completion topology
+  shell: cd {{ install_path }}/topology/completion && chmod +x *.sh && ./stop.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: stop flink livecharts topology
+  shell: cd {{ install_path }}/topology/livecharts && chmod +x *.sh && ./stop.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: stop flink radiusOnOff topology
+  shell: cd {{ install_path }}/topology/radiusOnOff && chmod +x *.sh && ./stop.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: stop flink dos-detection topology
+  shell: cd {{ install_path }}/topology/dos-detection && chmod +x *.sh && ./stop.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: stop flink voiprelation topology
+  shell: cd {{ install_path }}/topology/voipRelation && chmod +x *.sh && ./stop.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: start flink subscriberHbase topology
+  shell: cd {{ install_path }}/topology/accountHbase && chmod +x *.sh && ./start.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: start flink completion topology
+  shell: cd {{ install_path }}/topology/completion && chmod +x *.sh && ./start.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: start flink livecharts topology
+  shell: cd {{ install_path }}/topology/livecharts && chmod +x *.sh && ./start.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: start flink radiusOnOff topology
+  shell: cd {{ install_path }}/topology/radiusOnOff && chmod +x *.sh && ./start.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: start flink dos-detection topology
+  shell: cd {{ install_path }}/topology/dos-detection && chmod +x *.sh && ./start.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
+- name: start flink voiprelation topology
+  shell: cd {{ install_path }}/topology/voipRelation && chmod +x *.sh && ./start.sh config/
+  run_once: true
+  delegate_facts: true
+  delegate_to: "{{ master_ip }}"
+
diff --git a/parcels/roles/init/flink/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2
new file mode 100644
index 0000000..9ad5a5b
--- /dev/null
+++ b/parcels/roles/init/flink/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/active_defence_event_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=ACTIVE-DEFENCE-EVENT-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=ACTIVE-DEFENCE-EVENT-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=active-defence-log-20210124-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-active-defence
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-active-defence
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=1
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/CONNECTION-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/CONNECTION-RECORD-COMPLETED-LOG.j2
new file mode 100644
index 0000000..9182294
--- /dev/null
+++ b/parcels/roles/init/flink/templates/CONNECTION-RECORD-COMPLETED-LOG.j2
@@ -0,0 +1,74 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/connection_record_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=CONNECTION-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=CONNECTION-RECORD-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=connection-record-log-20210510-A
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-connection-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-connection-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=0
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
diff --git a/parcels/roles/init/flink/templates/DOS-DETECTION-APPLICATION.j2 b/parcels/roles/init/flink/templates/DOS-DETECTION-APPLICATION.j2
new file mode 100644
index 0000000..bdac1f8
--- /dev/null
+++ b/parcels/roles/init/flink/templates/DOS-DETECTION-APPLICATION.j2
@@ -0,0 +1,107 @@
+#flink运行环境并行度，其优先级低于算子并行度，如果未设置算子并行度，则使用该数值
+stream.execution.environment.parallelism=1
+
+#flink任务名，一般不变
+stream.execution.job.name=DOS-DETECTION-APPLICATION
+
+#输入kafka并行度大小
+kafka.input.parallelism=1
+
+#输入kafka topic名
+kafka.input.topic.name=DOS-SKETCH-LOG
+
+#输入kafka地址
+kafka.input.bootstrap.servers={{ kafka_source_servers }}
+
+#读取kafka group id
+kafka.input.group.id=dos-detection-job-210817-1
+
+#发送kafka metrics并行度大小
+kafka.output.metric.parallelism=1
+
+#发送kafka metrics topic名
+kafka.output.metric.topic.name=TRAFFIC-TOP-DESTINATION-IP-METRICS-LOG
+
+#发送kafka event并行度大小
+kafka.output.event.parallelism=1
+
+#发送kafka event topic名
+kafka.output.event.topic.name=DOS-EVENT-LOG
+
+#kafka输出地址
+kafka.output.bootstrap.servers={{ kafka_sink_servers }}
+
+#zookeeper地址
+hbase.zookeeper.quorum={{ zookeeper_servers }}
+
+#hbase客户端处理时间
+hbase.client.operation.timeout=30000
+hbase.client.scanner.timeout.period=30000
+
+##hbase baseline表名
+hbase.baseline.table.name=ddos_traffic_baselines
+
+#读取baseline限制
+hbase.baseline.total.num=1000000
+
+#设置聚合并行度，2个key
+flink.first.agg.parallelism=1
+
+#设置结果判定并行度
+flink.detection.map.parallelism=1
+
+#watermark延迟
+flink.watermark.max.orderness=1
+
+#计算窗口大小，默认600s
+flink.window.max.time=600
+
+#dos event结果中distinct source IP限制
+source.ip.list.limit=10000
+
+#基于目的IP的分区数，默认为10000，一般不变
+destination.ip.partition.num=10000
+
+data.center.id.num=15
+
+#IP mmdb库路径
+ip.mmdb.path={{ install_path }}/topology/dat/
+
+#基于baseline判定dos攻击的上下限
+baseline.sessions.minor.threshold=0.1
+baseline.sessions.warning.threshold=0.5
+baseline.sessions.major.threshold=1
+baseline.sessions.severe.threshold=3
+baseline.sessions.critical.threshold=8
+
+#bifang服务访问地址
+bifang.server.uri=http://{{ bifang_mariadb_host }}:80
+
+#访问bifang服务用户名密码
+bifang.server.user=admin
+bifang.server.password=admin
+
+#加密密码路径信息
+bifang.server.encryptpwd.path=/v1/user/encryptpwd
+
+#登录bifang服务路径信息
+bifang.server.login.path=/v1/user/login
+
+#获取静态阈值路径信息
+bifang.server.policy.threshold.path=/v1/policy/profile/DoS/detection/threshold
+
+#http请求相关参数
+#最大连接数
+http.pool.max.connection=400
+
+#单路由最大连接数
+http.pool.max.per.route=80
+
+#向服务端请求超时时间设置(单位:毫秒)
+http.pool.request.timeout=60000
+
+#向服务端连接超时时间设置(单位:毫秒)
+http.pool.connect.timeout=60000
+
+#服务端响应超时时间设置(单位:毫秒)
+http.pool.response.timeout=60000
diff --git a/parcels/roles/init/flink/templates/GTPC-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/GTPC-RECORD-COMPLETED-LOG.j2
new file mode 100644
index 0000000..e436cc0
--- /dev/null
+++ b/parcels/roles/init/flink/templates/GTPC-RECORD-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/gtpc_record_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=GTPC-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=GTPC-RECORD-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=gtpc-record-log-20210510-A
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-gtpc-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-gtpc-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=2
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2 b/parcels/roles/init/flink/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2
new file mode 100644
index 0000000..dde181b
--- /dev/null
+++ b/parcels/roles/init/flink/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2
@@ -0,0 +1,54 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#--------------------------------HTTP------------------------------#
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/liveChart_history
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=CONNECTION-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=TRAFFIC-PROTOCOL-STAT-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=history-liveCharts-20210811-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-connection-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-connection-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+parse.map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+count.window.time=15
diff --git a/parcels/roles/init/flink/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2 b/parcels/roles/init/flink/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2
new file mode 100644
index 0000000..6011fad
--- /dev/null
+++ b/parcels/roles/init/flink/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2
@@ -0,0 +1,54 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#--------------------------------HTTP------------------------------#
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/liveChart_live
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=LIVE-SESSION-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=TRAFFIC-PROTOCOL-STAT-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=live-liveCharts-20210811-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-connection-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-connection-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+parse.map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+count.window.time=15
diff --git a/parcels/roles/init/flink/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2
new file mode 100644
index 0000000..14aea42
--- /dev/null
+++ b/parcels/roles/init/flink/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/live_session_record_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=LIVE-SESSION-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=LIVE-SESSION-RECORD-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=live-session-record-log-20210510-A
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-live-session-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-live-session-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=3
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/PROXY-EVENT-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/PROXY-EVENT-COMPLETED-LOG.j2
new file mode 100644
index 0000000..5d37674
--- /dev/null
+++ b/parcels/roles/init/flink/templates/PROXY-EVENT-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/proxy_event_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=PROXY-EVENT-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=PROXY-EVENT-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=proxy-event-log-20210124-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-proxy-event
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-proxy-event
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=4
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/RADIUS-ON-OFF.j2 b/parcels/roles/init/flink/templates/RADIUS-ON-OFF.j2
new file mode 100644
index 0000000..32d3410
--- /dev/null
+++ b/parcels/roles/init/flink/templates/RADIUS-ON-OFF.j2
@@ -0,0 +1,41 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=RADIUS-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=RADIUS-ONFF-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=radius-on-off-flink-20210615
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-connection-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-connection-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=1
+
+#map函数并行度
+map.parallelism=1
+
+#producer 并行度
+producer.parallelism=1
diff --git a/parcels/roles/init/flink/templates/RADIUS-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/RADIUS-RECORD-COMPLETED-LOG.j2
new file mode 100644
index 0000000..404969c
--- /dev/null
+++ b/parcels/roles/init/flink/templates/RADIUS-RECORD-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/radius_record_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=RADIUS-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=RADIUS-RECORD-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=radius-record-log-20210124-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-radius-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-radius-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=5
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/RADIUS-RELATIONSHIP-HBASE.j2 b/parcels/roles/init/flink/templates/RADIUS-RELATIONSHIP-HBASE.j2
new file mode 100644
index 0000000..9e40662
--- /dev/null
+++ b/parcels/roles/init/flink/templates/RADIUS-RELATIONSHIP-HBASE.j2
@@ -0,0 +1,30 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=RADIUS-RECORD-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=radius-flink-20210623
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-radius-subscriber
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#hbase table name
+hbase.table.name=subscriber_info
+
diff --git a/parcels/roles/init/flink/templates/SECURITY-EVENT-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/SECURITY-EVENT-COMPLETED-LOG.j2
new file mode 100644
index 0000000..d22084e
--- /dev/null
+++ b/parcels/roles/init/flink/templates/SECURITY-EVENT-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/security_event_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=SECURITY-EVENT-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=SECURITY-EVENT-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=security-event-log-20201209-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-security-event
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-security-event
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=6
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2
new file mode 100644
index 0000000..aeb464c
--- /dev/null
+++ b/parcels/roles/init/flink/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/sys_packet_capture_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=SYS-PACKET-CAPTURE-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=SYS-PACKET-CAPTURE-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=sys-packet-log-20210124-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-security-event
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-security-event
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=7
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2
new file mode 100644
index 0000000..12492f8
--- /dev/null
+++ b/parcels/roles/init/flink/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/transaction_record_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=TRANSACTION-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=TRANSACTION-RECORD-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=transaction-record-log-20210510-A
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-transaction-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-transaction-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=8
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/VOIP-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/flink/templates/VOIP-RECORD-COMPLETED-LOG.j2
new file mode 100644
index 0000000..71b0339
--- /dev/null
+++ b/parcels/roles/init/flink/templates/VOIP-RECORD-COMPLETED-LOG.j2
@@ -0,0 +1,75 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#zookeeper 地址 用于配置log_id
+zookeeper.servers={{ zookeeper_servers }}
+
+#hbase zookeeper地址 用于连接HBase
+hbase.zookeeper.servers={{ zookeeper_servers }}
+
+#--------------------------------HTTP/定位库------------------------------#
+#定位库地址
+ip.library={{ install_path }}/topology/dat/
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/voip_record_log
+
+#网关APP_ID 获取接口
+app.id.http=http://{{ gateway_keepalive_host }}:9999/open-api/appDicList
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=VOIP-CONVERSATION-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=VOIP-RECORD-COMPLETED-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=voip-record-log-20210124-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#接收自kafka的消费者 client-id
+consumer.client.id=consumer-voip-record
+
+#回写给kafka的生产者 client-id
+producer.client.id=producer-voip-record
+
+#--------------------------------topology配置------------------------------#
+
+#consumer 并行度
+consumer.parallelism=3
+
+#map函数并行度
+map.parallelism=3
+
+#producer 并行度
+producer.parallelism=3
+
+#数据中心，取值范围(0-63)
+data.center.id.num=9
+
+#hbase 更新时间，如填写0则不更新缓存
+hbase.tick.tuple.freq.secs=180
+
+#app_id 更新时间，如填写0则不更新缓存
+app.tick.tuple.freq.secs=0
+
+#--------------------------------默认值配置------------------------------#
+
+#邮件默认编码
+mail.default.charset=UTF-8
+
+#0不需要补全原样输出日志，1需要补全
+log.need.complete=1
+
diff --git a/parcels/roles/init/flink/templates/VOIP-RELATION.j2 b/parcels/roles/init/flink/templates/VOIP-RELATION.j2
new file mode 100644
index 0000000..f834342
--- /dev/null
+++ b/parcels/roles/init/flink/templates/VOIP-RELATION.j2
@@ -0,0 +1,44 @@
+#--------------------------------地址配置------------------------------#
+
+#管理kafka地址
+input.kafka.servers={{ kafka_source_servers }}
+
+#管理输出kafka地址
+output.kafka.servers={{ kafka_sink_servers }}
+
+#--------------------------------HTTP------------------------------#
+
+#网关的schema位置
+schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/voip_record_log
+
+#--------------------------------Kafka消费组信息------------------------------#
+
+#kafka 接收数据topic
+input.kafka.topic=VOIP-RECORD-LOG
+
+#补全数据 输出 topic
+output.kafka.topic=VOIP-CONVERSATION-RECORD-LOG
+
+#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据；
+group.id=voip-relation-log-20210625-1
+
+#生产者压缩模式 none or snappy
+producer.kafka.compression.type=none
+
+#生产者ack
+producer.ack=1
+
+#--------------------------------topology配置------------------------------#
+
+#map函数并行度
+window.parallelism=1
+
+#voip日志对准窗口时间 seconds
+voip.calibration.window.time=15
+
+#单向流对准窗口时间 seconds
+one.sided.window.time=60
+
+#voip二次对准时间 seconds
+sec.combine.sr.cache.secs=300
+
diff --git a/parcels/roles/init/galaxy-job-service/templates/xxl_job.sql.j2 b/parcels/roles/init/galaxy-job-service/templates/xxl_job.sql.j2
index 257efaf..bafa01d 100644
--- a/parcels/roles/init/galaxy-job-service/templates/xxl_job.sql.j2
+++ b/parcels/roles/init/galaxy-job-service/templates/xxl_job.sql.j2
@@ -32,6 +32,7 @@ CREATE TABLE `xxl_job_group` (
 -- Records of xxl_job_group
 -- ----------------------------
 INSERT INTO `xxl_job_group` VALUES ('3', 'galaxy-executor', '数据平台业务执行器', '1', '{{ job_executor_servers }}');
+INSERT INTO `xxl_job_group` VALUES ('6', 'galaxyExecutorApplication', 'druid压缩程序', '1', '{{ job_executor_servers }}');
 
 -- ----------------------------
 -- Table structure for `xxl_job_info`
@@ -82,6 +83,7 @@ INSERT INTO `xxl_job_info` VALUES ('65', '3', '0 0 0 1/1 * ? ', '设置原始日
 INSERT INTO `xxl_job_info` VALUES ('66', '3', '0 0/5 * * * ?', 'Traffic-Top-Client-Ip', '2020-09-23 14:43:56', '2021-01-02 15:30:48', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n \"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n  \"method\": \"post\",\r\n \"requestBody\": {\r\n    \"query\": \"(SELECT common_client_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_client_ip AS source, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_client_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time, \'sessions\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n    \"context\": {\r\n      \"skipEmptyBuckets\": \"false\"\r\n   },\r\n    \"resultFormat\": \"object\"\r\n  },\r\n  \"resultKey\": \"\",\r\n  \"topic\": \"TOP-CLIENT-IP-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-09-23 14:43:56', '', '1', '1609739400000', '1609739700000');
 INSERT INTO `xxl_job_info` VALUES ('67', '3', '0 0/5 * * * ?', 'Traffic-Top-Server-Ip', '2020-09-23 14:46:37', '2021-01-02 15:30:21', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n \"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n  \"method\": \"post\",\r\n \"requestBody\": {\r\n    \"query\": \"(SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n   \"context\": {\r\n      \"skipEmptyBuckets\": \"false\"\r\n   },\r\n    \"resultFormat\": \"object\"\r\n  },\r\n  \"resultKey\": \"\",\r\n  \"topic\": \"TOP-SERVER-IP-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-09-23 14:46:37', '', '1', '1609739400000', '1609739700000');
 INSERT INTO `xxl_job_info` VALUES ('68', '3', '0 0 0 1/1 * ? ', '设置Druid hot日志保留天', '2020-09-25 19:29:09', '2020-09-28 11:36:17', 'zhq', '', 'FAILOVER', 'deleteDruidHotLogJobHandler', '{\"maxdays\":1}', 'DISCARD_LATER', '0', '2', 'BEAN', '', 'GLUE代码初始化', '2020-09-25 19:29:09', '', '1', '1603036800000', '1603123200000');
+INSERT INTO `xxl_job_info` VALUES ('86', '6', '0 0 1 * * ?', 'Compact-With-Day-Job', '2021-07-21 14:13:57', '2021-08-17 16:43:30', 'xpf', '', 'FAILOVER', 'druidCompactSegmentJobHandler', '{\r\n\"dataSource\":\"top_urls_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_website_domain_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_client_ip_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_server_ip_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_external_host_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_internal_host_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"security_event_hits_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"traffic_protocol_stat_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"traffic_metrics_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"traffic_protocol_stat_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2021-07-21 14:13:57', '', '1', '1629651600000', '1629738000000');
 
 -- ----------------------------
 -- Table structure for `xxl_job_lock`
@@ -190,4 +192,4 @@ CREATE TABLE `xxl_job_user` (
 -- Records of xxl_job_user
 -- ----------------------------
 INSERT INTO `xxl_job_user` VALUES ('1', 'admin', 'fea191a3fdd9f68503f9fa0e8d0293ab', '1', null);
-INSERT INTO `xxl_job_user` VALUES ('2', 'query', '44f057733c7a286299a972f6c0c239af', '0', '3');
+INSERT INTO `xxl_job_user` VALUES ('2', 'query', '95497ea23bf8d27d86526717578e366f', '0', '3');
diff --git a/parcels/roles/init/hbase/templates/create-hbase-table.sh.j2 b/parcels/roles/init/hbase/templates/create-hbase-table.sh.j2
index 96eca35..383c8c2 100644
--- a/parcels/roles/init/hbase/templates/create-hbase-table.sh.j2
+++ b/parcels/roles/init/hbase/templates/create-hbase-table.sh.j2
@@ -10,5 +10,7 @@ create 'tsg:report_result', {NAME => 'response', VERSIONS => 1,COMPRESSION => 'G
 
 create 'sub:subscriber_info', {NAME => 'subscriber_id', VERSIONS => 1}
 
+create 'ddos_traffic_baselines', 'TCP SYN Flood','UDP Flood','ICMP Flood', 'DNS Amplification'
+
 list
 EOF
diff --git a/parcels/roles/init/kafka/templates/create_topic.sh.j2 b/parcels/roles/init/kafka/templates/create_topic.sh.j2
index 5fe24b2..a7455c2 100644
--- a/parcels/roles/init/kafka/templates/create_topic.sh.j2
+++ b/parcels/roles/init/kafka/templates/create_topic.sh.j2
@@ -60,3 +60,8 @@ createTopic 2 {{ partion_nums }} TRAFFIC-PROTOCOL-STAT-LOG
 createTopic 2 {{ partion_nums }} PXY-EXCH-INTERMEDIA-CERT
 createTopic 2 {{ partion_nums }} INTERNAL-PACKET-CAPTURE-LOG
 createTopic 2 {{ partion_nums }} INTERNAL-RTP-LOG
+
+#dos
+createTopic 2 {{ partion_nums }} DOS-SKETCH-LOG
+createTopic 2 {{ partion_nums }} DOS-EVENT-LOG
+createTopic 2 {{ partion_nums }} TRAFFIC-TOP-DESTINATION-IP-METRICS-LOG
diff --git a/parcels/roles/init/spark/templates/application.properties.j2 b/parcels/roles/init/spark/templates/application.properties.j2
index fd9493f..567d08e 100644
--- a/parcels/roles/init/spark/templates/application.properties.j2
+++ b/parcels/roles/init/spark/templates/application.properties.j2
@@ -10,7 +10,7 @@ master=spark://{{ groups.spark[0] }}:7077
 spark.read.clickhouse.url=jdbc:clickhouse://{{ gateway_keepalive_host }}:8123/tsg_galaxy_v3
 spark.read.clickhouse.driver=ru.yandex.clickhouse.ClickHouseDriver
 spark.read.clickhouse.user=default
-spark.read.clickhouse.password=ceiec2019
+spark.read.clickhouse.password=galaxy2019
 spark.read.clickhouse.numPartitions=5
 spark.read.clickhouse.fetchsize=50000
 spark.read.clickhouse.partitionColumn=LAST_FOUND_TIME
@@ -19,7 +19,7 @@ clickhouse.socket.timeout=3600000
 arangoDB.host={{ groups.arangodb[0] }}
 arangoDB.port=8529
 arangoDB.user=upsert
-arangoDB.password=ceiec2018
+arangoDB.password=galaxy2018
 arangoDB.DB.name=tsg_galaxy_v3
 arangoDB.ttl=3600
 
diff --git a/parcels/roles/init/storm/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2
index a66e3d8..4a6aaf2 100644
--- a/parcels/roles/init/storm/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/ACTIVE-DEFENCE-EVENT-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/CONNECTION-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/CONNECTION-RECORD-COMPLETED-LOG.j2
index aab6e56..f407ede 100644
--- a/parcels/roles/init/storm/templates/CONNECTION-RECORD-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/CONNECTION-RECORD-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/GTPC-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/GTPC-RECORD-COMPLETED-LOG.j2
index b18f3dc..4395926 100644
--- a/parcels/roles/init/storm/templates/GTPC-RECORD-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/GTPC-RECORD-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2 b/parcels/roles/init/storm/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2
index 1ddfa5c..bebb897 100644
--- a/parcels/roles/init/storm/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2
+++ b/parcels/roles/init/storm/templates/LIVE-CHARTS_CONNECTION-RECORD-LOG.j2
@@ -1,9 +1,9 @@
 #--------------------------------地址配置------------------------------#
 #管理kafka地址
-bootstrap.servers={{ consumer_kafka_servers }}
+bootstrap.servers={{ kafka_source_servers }}
 
 #输出topic
-results.bootstrap.servers={{ producer_kafka_servers }}
+results.bootstrap.servers={{ kafka_sink_servers }}
 
 #--------------------------------Kafka消费组信息------------------------------#
 #kafka broker下的topic名称
diff --git a/parcels/roles/init/storm/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2 b/parcels/roles/init/storm/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2
index 7a9d454..4b576b8 100644
--- a/parcels/roles/init/storm/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2
+++ b/parcels/roles/init/storm/templates/LIVE-CHARTS_LIVE-SESSION-RECORD-LOG.j2
@@ -1,9 +1,9 @@
 #--------------------------------地址配置------------------------------#
 #管理kafka地址
-bootstrap.servers={{ consumer_kafka_servers }}
+bootstrap.servers={{ kafka_source_servers }}
 
 #输出topic
-results.bootstrap.servers={{ producer_kafka_servers }}
+results.bootstrap.servers={{ kafka_sink_servers }}
 
 #--------------------------------Kafka消费组信息------------------------------#
 #kafka broker下的topic名称
diff --git a/parcels/roles/init/storm/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2
index de3335c..7aaa3d3 100644
--- a/parcels/roles/init/storm/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/LIVE-SESSION-RECORD-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/PROXY-EVENT-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/PROXY-EVENT-COMPLETED-LOG.j2
index 9c14cfe..647fba5 100644
--- a/parcels/roles/init/storm/templates/PROXY-EVENT-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/PROXY-EVENT-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/RADIUS-ON-OFF.j2 b/parcels/roles/init/storm/templates/RADIUS-ON-OFF.j2
index 3b4d25c..30ac5c9 100644
--- a/parcels/roles/init/storm/templates/RADIUS-ON-OFF.j2
+++ b/parcels/roles/init/storm/templates/RADIUS-ON-OFF.j2
@@ -1,5 +1,5 @@
 #管理kafka地址
-bootstrap.servers={{ consumer_kafka_servers }}
+bootstrap.servers={{ kafka_source_servers }}
 
 #kafka broker下的topic名称
 kafka.topic=RADIUS-RECORD-LOG
@@ -8,7 +8,7 @@ kafka.topic=RADIUS-RECORD-LOG
 group.id=radius-onff-log-20200818-1
 
 #输出kafka server
-results.output.servers={{ producer_kafka_servers }}
+results.output.servers={{ kafka_sink_servers }}
 
 #输出topic
 results.output.topic=RADIUS-ONFF-LOG
diff --git a/parcels/roles/init/storm/templates/RADIUS-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/RADIUS-RECORD-COMPLETED-LOG.j2
index fb45b4a..d02d48c 100644
--- a/parcels/roles/init/storm/templates/RADIUS-RECORD-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/RADIUS-RECORD-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/SECURITY-EVENT-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/SECURITY-EVENT-COMPLETED-LOG.j2
index a1f5a56..616f21c 100644
--- a/parcels/roles/init/storm/templates/SECURITY-EVENT-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/SECURITY-EVENT-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/SUBSCRUBER-HBASE.j2 b/parcels/roles/init/storm/templates/SUBSCRUBER-HBASE.j2
index 80ceb9d..f52c9fc 100644
--- a/parcels/roles/init/storm/templates/SUBSCRUBER-HBASE.j2
+++ b/parcels/roles/init/storm/templates/SUBSCRUBER-HBASE.j2
@@ -1,5 +1,5 @@
 #管理kafka地址
-bootstrap.servers={{ consumer_kafka_servers }}
+bootstrap.servers={{ kafka_source_servers }}
 
 #从kafka哪里开始读：earliest/latest
 auto.offset.reset=latest
diff --git a/parcels/roles/init/storm/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2
index 7bfe9fb..fc20144 100644
--- a/parcels/roles/init/storm/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/SYS-PACKET-CAPTURE-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2
index 7732bb8..8286242 100644
--- a/parcels/roles/init/storm/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/TRANSACTION-RECORD-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/VOIP-RECORD-COMPLETED-LOG.j2 b/parcels/roles/init/storm/templates/VOIP-RECORD-COMPLETED-LOG.j2
index 70cfae2..a1b8c6c 100644
--- a/parcels/roles/init/storm/templates/VOIP-RECORD-COMPLETED-LOG.j2
+++ b/parcels/roles/init/storm/templates/VOIP-RECORD-COMPLETED-LOG.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #zookeeper 地址 用于配置log_id
 zookeeper.servers={{ zookeeper_servers }}
diff --git a/parcels/roles/init/storm/templates/VOIP-RELATION.j2 b/parcels/roles/init/storm/templates/VOIP-RELATION.j2
index c198cad..2d134ee 100644
--- a/parcels/roles/init/storm/templates/VOIP-RELATION.j2
+++ b/parcels/roles/init/storm/templates/VOIP-RELATION.j2
@@ -1,10 +1,10 @@
 #--------------------------------地址配置------------------------------#
 
 #管理kafka地址
-input.kafka.servers={{ consumer_kafka_servers }}
+input.kafka.servers={{ kafka_source_servers }}
 
 #管理输出kafka地址
-output.kafka.servers={{ producer_kafka_servers }}
+output.kafka.servers={{ kafka_sink_servers }}
 
 #网关的schema位置
 schema.http=http://{{ gateway_keepalive_host }}:9999/metadata/schema/v1/fields/voip_record_log
diff --git a/parcels/roles/services/galaxy-chproxy/templates/config.yml.j2 b/parcels/roles/services/galaxy-chproxy/templates/config.yml.j2
index 6408abc..2a5a353 100644
--- a/parcels/roles/services/galaxy-chproxy/templates/config.yml.j2
+++ b/parcels/roles/services/galaxy-chproxy/templates/config.yml.j2
@@ -9,14 +9,14 @@ users:
   - name: "tsg_report"
     to_cluster: "report"
     to_user: "tsg_report"
-    password: "ceiec2019"
+    password: "galaxy2019"
     max_queue_size: 100
     max_queue_time: 21700s
 
   - name: "tsg_query"
     to_cluster: "query"
     to_user: "tsg_query"
-    password: "ceiec2018"
+    password: "galaxy2018"
     max_queue_size: 100
     max_queue_time: 610s
     cache: "shortterm"
@@ -24,7 +24,7 @@ users:
   - name: "default"
     to_cluster: "report"
     to_user: "default"
-    password: "ceiec2019"
+    password: "galaxy2019"
     max_queue_size: 100
     max_queue_time: 3610s
 # by default each cluster has `default` user which can be overridden by section `users`
@@ -37,9 +37,9 @@ clusters:
     masternode: 1
     users:
       - name: "default"
-        password: "ceiec2019"
+        password: "galaxy2019"
       - name: "tsg_report"
-        password: "ceiec2019"
+        password: "galaxy2019"
   - name: "query"
     nodes: [
       "{{groups.clickhouse[1]}}:8123",
@@ -48,7 +48,7 @@ clusters:
     masternode: 1
     users:
       - name: "tsg_query"
-        password: "ceiec2018"
+        password: "galaxy2018"
 caches:
   - name: "shortterm"
     dir: "/home/cache"
diff --git a/parcels/roles/services/galaxy-gateway-keepalive/tasks/main.yml b/parcels/roles/services/galaxy-gateway-keepalive/tasks/main.yml
index 6722f8c..d76fcba 100644
--- a/parcels/roles/services/galaxy-gateway-keepalive/tasks/main.yml
+++ b/parcels/roles/services/galaxy-gateway-keepalive/tasks/main.yml
@@ -1,3 +1,8 @@
+#关闭旧的自启进程
+- name: kill kp_daemon.sh
+  shell: ps aux | grep kp_daemon | grep -v grep | awk '{print $2}' | xargs kill 2>/dev/null 
+
+
 #创建文件夹
 - name: create keepalived package path:{{ keepalived_package_path }}
   file:
diff --git a/parcels/roles/services/galaxy-gateway-keepalive/templates/kp_daemon.sh.j2 b/parcels/roles/services/galaxy-gateway-keepalive/templates/kp_daemon.sh.j2
index 9cde9de..ba9ee48 100644
--- a/parcels/roles/services/galaxy-gateway-keepalive/templates/kp_daemon.sh.j2
+++ b/parcels/roles/services/galaxy-gateway-keepalive/templates/kp_daemon.sh.j2
@@ -7,7 +7,7 @@ logPath=$keepalivedPath/keepalived_daemon.log
 while true;do
    CHPROXY_COUNT=$(ps -ef | grep chproxy | grep -v grep | wc -l)
    NGINX_COUNT=$(ps -ef | grep nginx | grep -v grep | wc -l)
-   MARIADB_COUNT=$(ps -ef | grep mariadb | grep -v grep | wc -l)	
+   MARIADB_COUNT=$(ps -ef | grep mysqld | grep -v grep | wc -l)	
 
    if [[ $MARIADB_COUNT -eq "0" || $CHPROXY_COUNT -eq "0" || $NGINX_COUNT -eq "0" ]] 
 	then
diff --git a/parcels/roles/services/galaxy-gohangout/files/bin/ghoStart/start_gohangout_k2ck_dos_event_log_tsgv3.sh b/parcels/roles/services/galaxy-gohangout/files/bin/ghoStart/start_gohangout_k2ck_dos_event_log_tsgv3.sh
new file mode 100644
index 0000000..b8b0074
--- /dev/null
+++ b/parcels/roles/services/galaxy-gohangout/files/bin/ghoStart/start_gohangout_k2ck_dos_event_log_tsgv3.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+#gohangout启动文件
+
+#配置文件名称,注意配置文件需要放在$BASE_DIR/conf文件夹下
+YML_NAME=k2ck_dos_event_log_tsgv3
+#gohangout的二进制启动文件路径
+BASE_DIR=$(cd $(dirname $0); cd ../../; pwd)
+#日志级别,1,5,10,数字越大日志越详细
+LOG_LV=3
+#线程总数,即开启worker数量,每个线程拥有自己的filter, output,占用多份内存,默认1个线程
+THREAD_SUM=1
+#进程总数
+PROCESS_SUM=$1
+
+if [ ! -d "$BASE_DIR/logs" ]; then
+        mkdir -p $BASE_DIR/logs
+fi
+
+echo "###########################$(date +%Y%m%d%H%M%S)###########################" >> $BASE_DIR/bin/start_log/${YML_NAME}_restart.log
+id=0
+logid=0
+while true ; do
+    NUM=`ps -ef | grep -w ${YML_NAME}.yml | grep -v grep |wc -l`
+    pids=$(ps -ef | grep -w ${YML_NAME}.yml | grep -v grep | awk '{print $2}')
+    time_stamp=$(date +%Y%m%d%H%M%S)
+    if [ "${NUM}" -lt ${PROCESS_SUM} ];then
+	$BASE_DIR/bin/gohangout --config $BASE_DIR/conf/${YML_NAME}.yml --logtostderr --v ${LOG_LV} --worker ${THREAD_SUM} >> $BASE_DIR/logs/${YML_NAME}.log 2>&1 &
+    echo "${time_stamp} ---> the ${YML_NAME}APP restart ---> $id" >> $BASE_DIR/bin/start_log/${YML_NAME}_restart.log
+    ((logid++))
+    ((id++))
+     if [ ${logid} -gt ${PROCESS_SUM} ];then
+      logid=0
+      pids=$(ps -ef | grep -w ${YML_NAME}.yml | grep -v grep | awk '{print $2}')
+        for pid in $pids
+        do
+         kill -9  $pid
+        done
+        echo "kafka or clickhouse is error,reset gohangout,sleep 30s... ..." >> $BASE_DIR/bin/start_log/${YML_NAME}_restart.log
+        sleep 30
+     fi
+    #大于设置进程数,杀掉所有进程,重启
+    elif [ "${NUM}" -gt ${PROCESS_SUM} ];then
+        for pid in $pids
+        do
+         kill -9  $pid
+        done
+    id=0
+    fi
+        sleep 1
+done
diff --git a/parcels/roles/services/galaxy-gohangout/files/start_all.sh b/parcels/roles/services/galaxy-gohangout/files/start_all.sh
index 81dcaf8..92cc6a9 100755
--- a/parcels/roles/services/galaxy-gohangout/files/start_all.sh
+++ b/parcels/roles/services/galaxy-gohangout/files/start_all.sh
@@ -4,7 +4,7 @@ STARTDIR=$(cd $(dirname $0); pwd)
 
 
 #docker模式
-#nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_active_defence_event_log_tsgv3.sh $1 > /dev/null 2>&1 &
+nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_active_defence_event_log_tsgv3.sh $1 > /dev/null 2>&1 &
 nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_connection_record_log_tsgv3.sh $1 > /dev/null 2>&1 &
 nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_proxy_event_log_tsgv3.sh $1 > /dev/null 2>&1 &
 nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_radius_record_log_tsgv3.sh $1 > /dev/null 2>&1 &
@@ -14,5 +14,5 @@ nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_voip_record_log_tsgv3.sh $1 >
 nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_gtpc_record_log_tsgv3.sh $1 > /dev/null 2>&1 &
 nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_live_session_record_log_tsgv3.sh $1 > /dev/null 2>&1 &
 nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_transaction_record_log_tsgv3.sh $1 > /dev/null 2>&1 &
+nohup $STARTDIR/bin/ghoStart/start_gohangout_k2ck_dos_event_log_tsgv3.sh $1 > /dev/null 2>&1 &
 $STARTDIR/bin/ghoStart/start_gohangout_k2ck_security_event_log_tsgv3.sh $1
-
diff --git a/parcels/roles/services/galaxy-gohangout/tasks/load_gohangout.yml b/parcels/roles/services/galaxy-gohangout/tasks/load_gohangout.yml
index 62d8d45..cc2380f 100644
--- a/parcels/roles/services/galaxy-gohangout/tasks/load_gohangout.yml
+++ b/parcels/roles/services/galaxy-gohangout/tasks/load_gohangout.yml
@@ -124,6 +124,12 @@
     dest: '{{ install_path }}/{{ gohangout_volume_path }}/conf/k2ck_transaction_record_log_tsgv3.yml'
     backup: yes
 
+- name: copy {{ gohangout_image_name }} k2ck_dos_event_log_tsgv3.yml
+  template:
+    src: k2ck_dos_event_log_tsgv3.yml.j2
+    dest: '{{ install_path }}/{{ gohangout_volume_path }}/conf/k2ck_dos_event_log_tsgv3.yml'
+    backup: yes
+
 - name: copy  {{ gohangout_image_name }} gholog.j2
   template:
     src: gholog.j2
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_active_defence_event_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_active_defence_event_log_tsgv3.yml.j2
index 709d82c..1c72f71 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_active_defence_event_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_active_defence_event_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: active_defence_event_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.active_defence_event_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         hosts:
 {% for ip in groups.clickhouse %}
 {% if (groups.clickhouse[0]) != ip and (groups.clickhouse[1]) != ip%}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_connection_record_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_connection_record_log_tsgv3.yml.j2
index 45987e1..fa377aa 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_connection_record_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_connection_record_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: connection_record_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.connection_record_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         hosts:
 {% for ip in groups.clickhouse %}
 {% if (groups.clickhouse[0]) != ip and (groups.clickhouse[1]) != ip%}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_dos_event_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_dos_event_log_tsgv3.yml.j2
new file mode 100644
index 0000000..e8df096
--- /dev/null
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_dos_event_log_tsgv3.yml.j2
@@ -0,0 +1,33 @@
+inputs:
+    - Kafka:
+        topic:
+            DOS-EVENT-LOG: 1
+        #assign:
+        #  weblog: [0,9]
+        codec: json
+        consumer_settings:
+            bootstrap.servers: "ip:{{ kafka_source_servers }}"
+            group.id: gohangout_dos_event_log_tsgv3_1
+            max.partition.fetch.bytes: '10485760'
+            auto.commit.interval.ms: '5000'
+            # from.beginning: 'true'
+            # sasl.mechanism: PLAIN
+            # sasl.user: admin
+            # sasl.password: admin-secret
+
+outputs:
+    - Clickhouse:
+        table: 'tsg_galaxy_v3.dos_event_log_local'
+        username: 'default'
+        password: 'galaxy2019'
+        conn_max_life_time: 60
+        hosts:
+{% for ip in groups.clickhouse %}
+{% if (groups.clickhouse[0]) != ip and (groups.clickhouse[1]) != ip%}
+        - 'tcp://{{ ip }}:9001'
+{% endif %}
+{% endfor %}
+        bulk_actions: 100000
+        flush_interval: 10
+        concurrent: 2
+        conn_max_life_time: 60
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_gtpc_record_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_gtpc_record_log_tsgv3.yml.j2
index c5384e5..ed99b39 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_gtpc_record_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_gtpc_record_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: gtpc_record_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.gtpc_record_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         conn_max_life_time: 60
         hosts:
 {% for ip in groups.clickhouse %}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_live_session_record_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_live_session_record_log_tsgv3.yml.j2
index 70d107c..3ede186 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_live_session_record_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_live_session_record_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: live_session_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.live_session_record_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         conn_max_life_time: 60
         hosts:
 {% for ip in groups.clickhouse %}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_proxy_event_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_proxy_event_log_tsgv3.yml.j2
index d872007..ec0a05a 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_proxy_event_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_proxy_event_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: proxy_event_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.proxy_event_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         hosts:
 {% for ip in groups.clickhouse %}
 {% if (groups.clickhouse[0]) != ip and (groups.clickhouse[1]) != ip%}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_onff_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_onff_log_tsgv3.yml.j2
index 7dd30dc..f5d99d9 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_onff_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_onff_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: radius_onff_log_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.radius_onff_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         hosts:
 {% for ip in groups.clickhouse %}
 {% if (groups.clickhouse[0]) != ip and (groups.clickhouse[1]) != ip%}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_record_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_record_log_tsgv3.yml.j2
index e91ffa0..e8b6895 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_record_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_radius_record_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: radius_record_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.radius_record_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         hosts:
 {% for ip in groups.clickhouse %}
 {% if (groups.clickhouse[0]) != ip and (groups.clickhouse[1]) != ip%}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_security_event_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_security_event_log_tsgv3.yml.j2
index c640f32..4e1afa6 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_security_event_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_security_event_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: security_event_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.security_event_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         hosts:
 {% for ip in groups.clickhouse %}
 {% if (groups.clickhouse[0]) != ip and (groups.clickhouse[1]) != ip%}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_sys_packet_capture_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_sys_packet_capture_log_tsgv3.yml.j2
index fb86005..d752d2c 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_sys_packet_capture_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_sys_packet_capture_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: sys_packet_capture_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.sys_packet_capture_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         hosts:
 {% for ip in groups.clickhouse %}
 {% if (groups.clickhouse[0]) != ip and (groups.clickhouse[1]) != ip%}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_transaction_record_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_transaction_record_log_tsgv3.yml.j2
index e6381dc..760d471 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_transaction_record_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_transaction_record_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: transaction_record_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.transaction_record_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         conn_max_life_time: 60
         hosts:
 {% for ip in groups.clickhouse %}
diff --git a/parcels/roles/services/galaxy-gohangout/templates/k2ck_voip_record_log_tsgv3.yml.j2 b/parcels/roles/services/galaxy-gohangout/templates/k2ck_voip_record_log_tsgv3.yml.j2
index 2496197..5f5749a 100644
--- a/parcels/roles/services/galaxy-gohangout/templates/k2ck_voip_record_log_tsgv3.yml.j2
+++ b/parcels/roles/services/galaxy-gohangout/templates/k2ck_voip_record_log_tsgv3.yml.j2
@@ -6,7 +6,7 @@ inputs:
         #  weblog: [0,9]
         codec: json
         consumer_settings:
-            bootstrap.servers: "{{ consumer_kafka_servers }}"
+            bootstrap.servers: "{{ kafka_source_servers }}"
             group.id: voip_record_completed_tsgv3
             max.partition.fetch.bytes: '10485760'
             auto.commit.interval.ms: '5000'
@@ -19,7 +19,7 @@ outputs:
     - Clickhouse:
         table: 'tsg_galaxy_v3.voip_record_log_local'
         username: 'default'
-        password: 'ceiec2019'
+        password: 'galaxy2019'
         conn_max_life_time: 60
         hosts:
 {% for ip in groups.clickhouse %}
diff --git a/parcels/roles/services/galaxy-hos-service/templates/application.yml.j2 b/parcels/roles/services/galaxy-hos-service/templates/application.yml.j2
index e9445d8..713afc9 100644
--- a/parcels/roles/services/galaxy-hos-service/templates/application.yml.j2
+++ b/parcels/roles/services/galaxy-hos-service/templates/application.yml.j2
@@ -3,7 +3,7 @@ nacos:
     type: yaml
     server-addr: {{ gateway_keepalive_host }}:8848
     namespace: {{ services_config_namespace }}
-    data-id: galaxy-hos-service.yml
+    data-id: galaxy-hos-service
     auto-refresh: true
     group: Galaxy
     username: nacos
@@ -12,9 +12,12 @@ nacos:
       enable: true
       log:
         enable: true
+  discovery:
+    service-name: hos
 spring:
   profiles:
     active: dev
+  application:
+    name: HosServiceApplication
 logging:
   config: ./config/log4j2-dev.xml
-
diff --git a/parcels/roles/services/galaxy-hos-service/templates/galaxy-hos-service.j2 b/parcels/roles/services/galaxy-hos-service/templates/galaxy-hos-service.j2
index ec03155..f4661c5 100644
--- a/parcels/roles/services/galaxy-hos-service/templates/galaxy-hos-service.j2
+++ b/parcels/roles/services/galaxy-hos-service/templates/galaxy-hos-service.j2
@@ -1,6 +1,8 @@
 #服务端口
 server:
   port: 8186
+  tomcat:
+    max-threads: 400
 #tomcat缓存大小，单位KB系统默认10M，配置10g
 tomcat:
   cacheMaxSize: {{ hos_tomcat_cache_size }}
@@ -32,7 +34,8 @@ hbase:
   namenodes: {{groups.hadoop[0]}},{{groups.hadoop[1]}}
   #hadoop端口
   hadoop_port: 9000
-  #用户白名单（hbase的namespace），获取存储配额
+  #建表时是否打开hbase wal，1打开，0关闭
+  openWal: 1
 #是否打开验证，0打开，打开需要使用S3身份验证或者token访问服务
 auth:
   open: 0
@@ -51,9 +54,14 @@ hos:
   simple: 1
   #hos验证
   token: c21f969b5f03d33d43e04f8f136e7682
+  #用户白名单（hbase的namespace），获取存储配额
   users: default
   #元数据存储占比
   metaProportion: 0.03 
+  #是否打开限流,0:关闭，1:打开
+  openRateLimiter: 0
+  #限流每秒请求数
+  rateLimiterQps: 10000
 #设置上传文件大小的最大值
 spring:
   servlet:
diff --git a/parcels/roles/services/galaxy-hos-service/templates/log4j2-dev.xml.j2 b/parcels/roles/services/galaxy-hos-service/templates/log4j2-dev.xml.j2
index 7f02b75..7d47329 100644
--- a/parcels/roles/services/galaxy-hos-service/templates/log4j2-dev.xml.j2
+++ b/parcels/roles/services/galaxy-hos-service/templates/log4j2-dev.xml.j2
@@ -8,7 +8,7 @@
         <!--最多产生10个压缩文件-->
         <property name="LOG_NUMS">10</property>
         <!--日志打印等级-->
-        <property name="LOG_LEVEL">info</property>
+        <property name="LOG_LEVEL">error</property>
         <!--日志文件路径-->
         <property name="LOG_PATH">logs</property>
         <!--日志文件名称-->
@@ -18,11 +18,12 @@
     </Properties>
 
     <appenders>
+        <!--
         <Console name="consoleSystemOutAppender" target="SYSTEM_OUT">
             <ThresholdFilter level="DEBUG" onMatch="ACCEPT" onMismatch="DENY"/>
             <PatternLayout pattern="${LOG_PATTERN}"/>
         </Console>
-
+        -->
         <RollingFile name="rollingFileAllAppender"
                      fileName="${LOG_PATH}/${LOG_FILE_NAME}.log"
                      filePattern="${LOG_PATH}/history/$${date:yyyy-MM-dd}/${LOG_FILE_NAME}-%d{yyyy-MM-dd}-%i.log.gz">
diff --git a/parcels/roles/services/galaxy-hos-service/templates/tmp/application.properties.j2 b/parcels/roles/services/galaxy-hos-service/templates/tmp/application.properties.j2
deleted file mode 100644
index ef6f3b2..0000000
--- a/parcels/roles/services/galaxy-hos-service/templates/tmp/application.properties.j2
+++ /dev/null
@@ -1,57 +0,0 @@
-#hbase参数
-hbase.zookeeper_quorum={{ zookeeper_servers }}
-hbase.zookeeper_property_clientPort=2181
-hbase.zookeeper_znode_parent=/hbase
-hbase.client_retries_number=1
-hbase.rpc_timeout=100000
-hbase.connect_pool=300
-hbase.client_write_buffer=10485760
-hbase.client_keyvalue_maxsize=1024000000
-#hbase索引表前缀，前缀为以下的都为索引表
-hbase.time_index_table_prefix=index_time_
-hbase.filename_index_table_prefix=index_filename_
-hbase.partfile_index_table_prefix=index_partfile_
-hbase.system_bucket_meta=system:bucket_meta
-#创建表预分区时的分区，为空则不分区
-hbase.region_start_key=1,2,3,4,5,6,7,8,9,a,b,c,d,e,f
-hbase.filename_head= 0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f
-
-#设置上传文件大小的最大值
-spring.servlet.multipart.max-file-size=1024MB
-spring.servlet.multipart.max-request-size=1024MB
-
-#批量删除对象的最大数量
-hos.deleteMultipleNumber=1000
-#获取对象列表等操作的最大值
-hos.maxResultLimit=10000
-#分块上传的最大分块数
-hos.maxPartNumber=1000
-#追加上传的最大次数
-hos.maxPosition=10000
-#存放文件元数据的请求头
-hos.metaHeader=x-hos-meta-message
-#是否打开对象列表查询功能，1打开
-hos.simple=1
-#是否打开验证，0打开，打开需要使用S3身份验证或者token访问服务
-auth.open=0
-#hos验证
-hos.token=c21f969b5f03d33d43e04f8f136e7682
-#tomcat缓存大小，单位KB，配置10g
-tomcat.cacheMaxSize={{ hos_tomcat_cache_size }}
-#服务端口
-server.port=8185
-#Prometheus参数
-spring.application.name=HosServiceApplication
-management.endpoints.web.exposure.include=*
-management.metrics.tags.application=${spring.application.name}
-logging.config= ./config/log4j2-dev.xml
-#获取文件大小的目录
-hbase.hbasePath=/hbase
-#1是集群0是单机，主要针对存储配额获取方式
-hbase.standone=1
-#hadoop集群namenode节点
-hbase.namenodes={{ groups.hadoop[0] }},{{ groups.hadoop[1] }}
-#hadoop端口
-hbase.hadoop_port=9000
-#用户白名单（hbase的namespace），获取存储配额
-hos.users=default
diff --git a/parcels/roles/services/galaxy-hos-service/templates/tmp/galaxy-hos-service.j2 b/parcels/roles/services/galaxy-hos-service/templates/tmp/galaxy-hos-service.j2
deleted file mode 100644
index 77f532a..0000000
--- a/parcels/roles/services/galaxy-hos-service/templates/tmp/galaxy-hos-service.j2
+++ /dev/null
@@ -1,74 +0,0 @@
-#服务端口
-server:
-  port: 8186
-#tomcat缓存大小，单位KB系统默认10M，配置10g
-tomcat:
-  cacheMaxSize: {{ hos_tomcat_cache_size }}
-#hbase参数
-hbase:
-  zookeeper_quorum: {{ zookeeper_servers }}
-  zookeeper_property_clientPort: 2181
-  zookeeper_znode_parent: /hbase
-  client_retries_number: 1
-  rpc_timeout: 100000
-  connect_pool: 300
-  client_write_buffer: 10485760
-  client_keyvalue_maxsize: 1024000000
-  #hbase索引表前缀，前缀为以下的都为索引表
-  time_index_table_prefix: index_time_
-  filename_index_table_prefix: index_filename_
-  partfile_index_table_prefix: index_partfile_
-  system_bucket_meta: system:bucket_meta
-  #创建表预分区时的分区，为空则不分区
-  region_start_key: 1,2,3,4,5,6,7,8,9,a,b,c,d,e,f
-  filename_head: 0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f
-  #获取文件大小的目录
-  hbasePath: /home/tsg/galaxy/data
-  #1是集群0是单机，主要针对存储配额获取方式
-  standone: 1
-  #hadoop集群namenode节点
-  namenodes: {{groups.hadoop[0]}},{{groups.hadoop[1]}}
-  #hadoop端口
-  hadoop_port: 9000
-  #用户白名单（hbase的namespace），获取存储配额
-#是否打开验证，0打开，打开需要使用S3身份验证或者token访问服务
-auth:
-  open: 0
-hos:
-  #批量删除对象的最大数量
-  deleteMultipleNumber: 1000
-  #获取对象列表等操作的最大值
-  maxResultLimit: 10000
-  #分块上传的最大分块数
-  maxPartNumber: 1000
-  #追加上传的最大次数
-  maxPosition: 10000
-  #存放文件元数据的请求头
-  metaHeader: x-hos-meta-message
-  #是否打开对象列表查询功能，1打开
-  simple: 1
-  #hos验证
-  token: c21f969b5f03d33d43e04f8f136e7682
-  users: default
-  #元数据存储占比
-  metaProportion: 0.03  
-#设置上传文件大小的最大值
-spring:
-  servlet:
-    multipart:
-      max-file-size: 1024MB
-      max-request-size: 1024MB
-#Prometheus参数
-  application:
-    name: HosServiceApplication
-#Prometheus参数
-management:
-  endpoints:
-    web:
-      exposure:
-        include: '*'
-  metrics:
-    tags:
-      application: ${spring.application.name}
-logging:
-  config: ./config/log4j2-dev.xml
diff --git a/parcels/roles/services/galaxy-hos-service/vars/main.yml b/parcels/roles/services/galaxy-hos-service/vars/main.yml
index 157c339..9f469ff 100644
--- a/parcels/roles/services/galaxy-hos-service/vars/main.yml
+++ b/parcels/roles/services/galaxy-hos-service/vars/main.yml
@@ -1,12 +1,12 @@
 #离线模式下使用:bifang-api的docker镜像文件名称,在../file中的文件名称
-hos_service_image_tar_name: galaxy-hos-service-21.07.01.tar
+hos_service_image_tar_name: galaxy-hos-service-21.08.25.tar
 
 ##########################公共属性#############################
 #{{ image_tar_name }}中的镜像名称,或者{{ docker_registry_image_and_tag }}中的镜像名称,不含版本号
 hos_service_image_name: galaxy-hos-service
 
 #{{ image_tar_name }}的镜像版本号,或者{{ docker_registry_image_and_tag }}中的镜像版本号
-hos_service_image_tag_name: 21.07.01
+hos_service_image_tag_name: 21.08.25
 
 #{{ image_tar_name }}的镜像,或者{{ docker_registry_image_and_tag }}中的镜像启动后的容器名称
 hos_service_image_container_name: galaxy-hos-service
diff --git a/parcels/roles/services/galaxy-job-service/templates/galaxy-job-executor.j2 b/parcels/roles/services/galaxy-job-service/templates/galaxy-job-executor.j2
index c079a0e..9f32207 100644
--- a/parcels/roles/services/galaxy-job-service/templates/galaxy-job-executor.j2
+++ b/parcels/roles/services/galaxy-job-service/templates/galaxy-job-executor.j2
@@ -24,7 +24,7 @@ storge.analytic.server=cityA|{{ gateway_keepalive_host }}:8089
 storge.traffic.server=cityA|{{ gateway_keepalive_host }}:8123
 storge.traffic.datasource=tsg_galaxy_v3
 storge.traffic.username=default
-storge.traffic.password=ceiec2019
+storge.traffic.password=galaxy2019
 #删除ttl
 storge.traffic.system.parts=system.parts
 #存储配额查询
@@ -59,4 +59,4 @@ http.pool.response.timeout=120000
 http.pool.max.per.route=300
 http.pool.connect.timeout=10000
 ##指定kafka server的地址，集群配多个，中间，逗号隔开
-spring.kafka.bootstrap-servers={{ producer_kafka_servers }}
+spring.kafka.bootstrap-servers={{ kafka_sink_servers }}
diff --git a/parcels/roles/services/galaxy-job-service/templates/xxl_job.sql.j2 b/parcels/roles/services/galaxy-job-service/templates/xxl_job.sql.j2
index 257efaf..3145589 100644
--- a/parcels/roles/services/galaxy-job-service/templates/xxl_job.sql.j2
+++ b/parcels/roles/services/galaxy-job-service/templates/xxl_job.sql.j2
@@ -25,13 +25,16 @@ CREATE TABLE `xxl_job_group` (
   `title` varchar(12) NOT NULL COMMENT '执行器名称',
   `address_type` tinyint(4) NOT NULL DEFAULT 0 COMMENT '执行器地址类型：0=自动注册、1=手动录入',
   `address_list` varchar(512) DEFAULT NULL COMMENT '执行器地址列表，多地址逗号分隔',
-  PRIMARY KEY (`id`)
-) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8mb4;
+  PRIMARY KEY (`id`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=8 DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
 -- ----------------------------
 -- Records of xxl_job_group
 -- ----------------------------
 INSERT INTO `xxl_job_group` VALUES ('3', 'galaxy-executor', '数据平台业务执行器', '1', '{{ job_executor_servers }}');
+INSERT INTO `xxl_job_group` VALUES ('6', 'galaxyExecutorApplication', 'druid压缩程序', '1', '{{ job_executor_servers }}');
+INSERT INTO `xxl_job_group` VALUES ('7', 'galaxy-executor', '数据清理执行器', '1', 'http://{{ job_executor_servers }}');
+
 
 -- ----------------------------
 -- Table structure for `xxl_job_info`
@@ -60,28 +63,34 @@ CREATE TABLE `xxl_job_info` (
   `trigger_status` tinyint(4) NOT NULL DEFAULT 0 COMMENT '调度状态：0-停止，1-运行',
   `trigger_last_time` bigint(13) NOT NULL DEFAULT 0 COMMENT '上次调度时间',
   `trigger_next_time` bigint(13) NOT NULL DEFAULT 0 COMMENT '下次调度时间',
-  PRIMARY KEY (`id`)
-) ENGINE=InnoDB AUTO_INCREMENT=77 DEFAULT CHARSET=utf8mb4;
+  PRIMARY KEY (`id`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=88 DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
 -- ----------------------------
 -- Records of xxl_job_info
 -- ----------------------------
-INSERT INTO `xxl_job_info` VALUES ('29', '3', '0 0 4 * * ?', '获取CK存储配额-sh(实时压缩负值问题）', '2020-03-26 10:58:09', '2020-08-03 10:04:29', 'zhq', '', 'FAILOVER', 'getStorageQuotaJobHandler', '{\"topic\":\"SYS-STORAGE-LOG\",\"ckDayGrowth\":\"true\"}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-03-26 10:58:09', '', '1', '1603051200000', '1603137600000');
-INSERT INTO `xxl_job_info` VALUES ('36', '3', '0 0/5 * * * ?', '获取所有存储配额-sh', '2020-04-07 21:41:20', '2020-08-03 10:30:05', 'zhq', '', 'FAILOVER', 'getStorageQuotaJobHandler', '{\"topic\":\"SYS-STORAGE-LOG\",\"ckDayGrowth\":\"false\"}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-07 21:41:20', '', '1', '1603074600000', '1603074900000');
-INSERT INTO `xxl_job_info` VALUES ('44', '3', '0 0/5 * * * ?', 'Event-Security-Proxy-Top-URLS-By-Hits', '2020-04-26 11:01:44', '2020-10-19 10:20:14', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n		\"query\": \"(SELECT url ,sum( session_num ) AS session_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time FROM security_event_urls_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP, \'PT5M\') GROUP BY url ORDER BY session_num DESC LIMIT 1000) UNION ALL(SELECT url, sum(session_num) AS session_num, TIME_FLOOR(CURRENT_TIMESTAMP, \'PT5M\') as stat_time FROM proxy_event_urls_hot_log WHERE __time >= TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP, \'PT5M\'), \'PT5M\', -1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP, \'PT5M\') GROUP BY url ORDER BY session_num DESC LIMIT 1000)\",\r\n		\"context\": {\r\n			\"skipEmptyBuckets\": \"false\"\r\n		},\r\n		\"resultFormat\": \"object\"\r\n	},\r\n	\"resultKey\": \"\",\r\n	\"topic\": \"TOP-URLS-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:01:44', '', '1', '1603074600000', '1603074900000');
-INSERT INTO `xxl_job_info` VALUES ('45', '3', '0 0/5 * * * ?', 'Traffic-Top-Website-Domain', '2020-04-26 11:18:26', '2021-01-02 15:33:03', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n  \"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n  \"method\": \"post\",\r\n \"requestBody\": {\r\n    \"query\": \"(SELECT domain,sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num,sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM website_domain_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND domain != \'\' GROUP BY domain ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT domain,sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num,sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM website_domain_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND domain != \'\' GROUP BY domain ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT domain,sum(session_num) AS session_num, sum(c2s_byte_num) AS c2s_byte_num, sum(s2c_byte_num) AS s2c_byte_num, sum(c2s_pkt_num) AS c2s_pkt_num,sum(s2c_pkt_num) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM website_domain_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND domain != \'\' GROUP BY domain ORDER BY session_num DESC LIMIT 1000)\",\r\n    \"context\": {\r\n      \"skipEmptyBuckets\": \"false\"\r\n   },\r\n    \"resultFormat\": \"object\"\r\n  },\r\n  \"resultKey\": \"\",\r\n  \"topic\": \"TOP-WEBSITE-DOMAIN-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:18:26', '', '1', '1609739400000', '1609739700000');
-INSERT INTO `xxl_job_info` VALUES ('46', '3', '0 0/5 * * * ?', 'Traffic-Top-User', '2020-04-26 11:23:08', '2021-01-02 15:32:34', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n  \"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n  \"method\": \"post\",\r\n \"requestBody\": {\r\n    \"query\": \"(SELECT common_subscriber_id as subscriber_id, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num,sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM user_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_subscriber_id != \'\' GROUP BY common_subscriber_id ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_subscriber_id as subscriber_id,sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM user_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_subscriber_id != \'\' GROUP BY common_subscriber_id ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_subscriber_id as subscriber_id,sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM user_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_subscriber_id != \'\' GROUP BY common_subscriber_id ORDER BY session_num DESC LIMIT 1000)\",\r\n   \"context\": {\r\n      \"skipEmptyBuckets\": \"false\"\r\n   },\r\n    \"resultFormat\": \"object\"\r\n  },\r\n  \"resultKey\": \"\",\r\n  \"topic\": \"TOP-USER-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:23:08', '', '1', '1609739400000', '1609739700000');
-INSERT INTO `xxl_job_info` VALUES ('47', '3', '0 0/5 * * * ?', 'Traffic-Top-External-Host', '2020-04-26 11:32:41', '2021-01-02 15:32:02', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n \"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n  \"method\": \"post\",\r\n \"requestBody\": {\r\n    \"query\": \"(SELECT common_external_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_external_ip != \'\' GROUP BY common_external_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_external_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_external_ip != \'\' GROUP BY common_external_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_external_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_external_ip != \'\' GROUP BY common_external_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n   \"context\": {\r\n      \"skipEmptyBuckets\": \"false\"\r\n   },\r\n    \"resultFormat\": \"object\"\r\n  },\r\n  \"resultKey\": \"\",\r\n  \"topic\": \"TOP-EXTERNAL-HOST-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:32:41', '', '1', '1609739400000', '1609739700000');
-INSERT INTO `xxl_job_info` VALUES ('48', '3', '0 0/5 * * * ?', 'Traffic-Top-Internal-Host', '2020-04-26 11:38:57', '2021-01-02 15:31:13', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n \"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n  \"method\": \"post\",\r\n \"requestBody\": {\r\n    \"query\": \"(SELECT common_internal_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_internal_ip != \'\' GROUP BY common_internal_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_internal_ip AS source, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_internal_ip != \'\' GROUP BY common_internal_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_internal_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time, \'sessions\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_internal_ip != \'\' GROUP BY common_internal_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n    \"context\": {\r\n      \"skipEmptyBuckets\": \"false\"\r\n   },\r\n    \"resultFormat\": \"object\"\r\n  },\r\n  \"resultKey\": \"\",\r\n  \"topic\": \"TOP-INTERNAL-HOST-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:38:57', '', '1', '1609739400000', '1609739700000');
-INSERT INTO `xxl_job_info` VALUES ('58', '3', '0 0 0 1/1 * ? ', '设置统计数据存储配额( Druid 保留天)', '2020-07-30 10:34:34', '2020-10-15 18:27:29', 'zhq', '', 'FAILOVER', 'deleteReportAndMetricsDataJobHandler', '{\"maxdays\":365}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 10:34:34', '', '1', '1603036800000', '1603123200000');
-INSERT INTO `xxl_job_info` VALUES ('59', '3', '0 0 0 1 * ?', '删除所有统计数据(Druid)', '2020-07-30 11:32:08', '2020-10-15 17:13:36', 'zhq', '', 'FAILOVER', 'deleteAllReportAndMetricsDataJobHandler', '{\"maxdays\":365}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 11:32:08', '', '0', '0', '0');
-INSERT INTO `xxl_job_info` VALUES ('62', '3', '0 0 0 1/1 * ? ', '设置文件存储配额( hos 保留天)', '2020-07-30 11:59:30', '2020-10-15 17:17:44', 'zhq', '', 'FAILOVER', 'deleteFilesJobHandler', '{\"maxdays\":365}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 11:59:30', '', '1', '1603036800000', '1603123200000');
-INSERT INTO `xxl_job_info` VALUES ('63', '3', '0 0 0 1 * ?', '删除所有文件(hos)', '2020-07-30 11:59:43', '2020-10-15 17:17:44', 'zhq', '', 'FAILOVER', 'deleteAllFilesJobHandler', '{\"maxdays\":365}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 11:59:43', '', '0', '0', '0');
-INSERT INTO `xxl_job_info` VALUES ('64', '3', '0 0 0 1 * ?', '删除所有原始日志(ClickHouse)', '2020-07-30 13:47:25', '2020-10-15 18:26:17', 'zhq', '', 'FAILOVER', 'deleteAllTrafficDataJobHandler', '{\"maxdays\":29}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 13:47:25', '', '0', '0', '0');
-INSERT INTO `xxl_job_info` VALUES ('65', '3', '0 0 0 1/1 * ? ', '设置原始日志存储配额（ClickHouse保留天）', '2020-07-30 13:47:38', '2020-10-15 18:27:08', 'zhq', '', 'FAILOVER', 'deleteTrafficDataJobHandler', '{\"maxdays\":30}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 13:47:38', '', '1', '1603036800000', '1603123200000');
-INSERT INTO `xxl_job_info` VALUES ('66', '3', '0 0/5 * * * ?', 'Traffic-Top-Client-Ip', '2020-09-23 14:43:56', '2021-01-02 15:30:48', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n \"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n  \"method\": \"post\",\r\n \"requestBody\": {\r\n    \"query\": \"(SELECT common_client_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_client_ip AS source, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_client_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time, \'sessions\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n    \"context\": {\r\n      \"skipEmptyBuckets\": \"false\"\r\n   },\r\n    \"resultFormat\": \"object\"\r\n  },\r\n  \"resultKey\": \"\",\r\n  \"topic\": \"TOP-CLIENT-IP-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-09-23 14:43:56', '', '1', '1609739400000', '1609739700000');
-INSERT INTO `xxl_job_info` VALUES ('67', '3', '0 0/5 * * * ?', 'Traffic-Top-Server-Ip', '2020-09-23 14:46:37', '2021-01-02 15:30:21', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n \"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n  \"method\": \"post\",\r\n \"requestBody\": {\r\n    \"query\": \"(SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n   \"context\": {\r\n      \"skipEmptyBuckets\": \"false\"\r\n   },\r\n    \"resultFormat\": \"object\"\r\n  },\r\n  \"resultKey\": \"\",\r\n  \"topic\": \"TOP-SERVER-IP-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-09-23 14:46:37', '', '1', '1609739400000', '1609739700000');
-INSERT INTO `xxl_job_info` VALUES ('68', '3', '0 0 0 1/1 * ? ', '设置Druid hot日志保留天', '2020-09-25 19:29:09', '2020-09-28 11:36:17', 'zhq', '', 'FAILOVER', 'deleteDruidHotLogJobHandler', '{\"maxdays\":1}', 'DISCARD_LATER', '0', '2', 'BEAN', '', 'GLUE代码初始化', '2020-09-25 19:29:09', '', '1', '1603036800000', '1603123200000');
+INSERT INTO `xxl_job_info` VALUES ('29', '3', '0 0 4 * * ?', 'ClickHouse Storage Usage', '2020-03-26 10:58:09', '2021-08-17 17:04:08', 'galaxy', '', 'FAILOVER', 'getStorageQuotaJobHandler', '{\"topic\":\"SYS-STORAGE-LOG\",\"ckDayGrowth\":\"true\"}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-03-26 10:58:09', '', '1', '1629921600000', '1630008000000');
+INSERT INTO `xxl_job_info` VALUES ('31', '3', '0 0 0/1 * * ?', 'Traffic-Top-Website-URLS(js)-By-Sessions-UniqSIP', '2020-03-31 10:39:09', '2021-03-18 15:49:33', 'ch', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\"url\":\"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\"method\":\"post\",\"requestBody\":{\"query\":\"select url,APPROX_COUNT_DISTINCT_DS_HLL(ip_object) as ip_num,session_num,max(content_length) as content_length,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,APPROX_COUNT_DISTINCT_DS_HLL(ip_object)*session_num as order_num from website_urls_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1*12*24) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') group by url,session_num order by order_num desc limit 1000\",\"context\":{\"sqlTimeZone\":\"Asia/Shanghai\",\"skipEmptyBuckets\":\"false\"},\"resultFormat\":\"object\"},\"resultKey\":\"\",\"topic\":\"TOP-WEBSITE-URLS-DAILY-LOG\"}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-03-31 10:39:09', '', '0', '0', '0');
+INSERT INTO `xxl_job_info` VALUES ('36', '3', '0 0/5 * * * ?', 'Global Storage Usage', '2020-04-07 21:41:20', '2021-08-17 17:03:44', 'galaxy', '', 'FAILOVER', 'getStorageQuotaJobHandler', '{\"topic\":\"SYS-STORAGE-LOG\",\"ckDayGrowth\":\"false\"}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-07 21:41:20', '', '1', '1629948000000', '1629948300000');
+INSERT INTO `xxl_job_info` VALUES ('40', '3', '0 0 0/1 * * ?', 'Traffic-Top-Website-Domain-by-Sessions-UniqSIP', '2020-04-23 11:14:25', '2020-10-15 11:06:29', 'galaxy', '', 'FAILOVER', 'druidNativeQueryToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2?pretty\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n				\"queryType\": \"topN\",\r\n		\"dataSource\": \"website_domain_hot_log\",\r\n		\"granularity\": \"hour\",\r\n		\"metric\": \"session_num\",\r\n		\"dimension\": \"domain\",\r\n		\"threshold\": 1000,\r\n		\"aggregations\": [{\r\n			\"type\": \"groupUniq\",\r\n			\"name\": \"protocol_type\",\r\n			\"fieldName\": \"protocol_type\",\r\n			\"maxStringBytes\": 100\r\n		}, {\r\n			\"type\": \"longSum\",\r\n			\"name\": \"session_num\",\r\n			\"fieldName\": \"session_num\"\r\n		}, {\r\n			\"type\": \"HLLSketchMerge\",\r\n			\"name\": \"ip_num\",\r\n			\"fieldName\": \"ip_object\",\r\n			\"lgK\": 12,\r\n			\"tgtHllType\": \"HLL_4\",\r\n			\"round\": true\r\n		}],\r\n		\"postAggregations\": [{\r\n			\"type\": \"arithmetic\",\r\n			\"name\": \"order_num\",\r\n			\"fn\": \"*\",\r\n			\"fields\": [{\r\n				\"type\": \"hyperUniqueCardinality\",\r\n				\"fieldName\": \"ip_num\"\r\n			}, {\r\n				\"type\": \"fieldAccess\",\r\n				\"name\": \"rows\",\r\n				\"fieldName\": \"session_num\"\r\n			}]\r\n		}],\r\n		\"intervals\": [\"2020-04-21T11:00:00/2020-04-22T11:00:00\"]\r\n	},\r\n	\"topic\": \"TOP-DOMAIN-RECOMMEND-DAILY-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-23 11:14:25', '', '1', '1629946800000', '1629950400000');
+INSERT INTO `xxl_job_info` VALUES ('44', '3', '0 0/5 * * * ?', 'Event-Security-Proxy-Top-URLS-By-Hits', '2020-04-26 11:01:44', '2020-10-15 11:06:21', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n		\"query\": \"(SELECT url ,sum( session_num ) AS session_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time FROM security_event_urls_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP, \'PT5M\') GROUP BY url ORDER BY session_num DESC LIMIT 1000) UNION ALL(SELECT url, sum(session_num) AS session_num, TIME_FLOOR(CURRENT_TIMESTAMP, \'PT5M\') as stat_time FROM proxy_event_urls_hot_log WHERE __time >= TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP, \'PT5M\'), \'PT5M\', -1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP, \'PT5M\') GROUP BY url ORDER BY session_num DESC LIMIT 1000)\",\r\n		\"context\": {\r\n			\"sqlTimeZone\": \"Asia/Shanghai\",\r\n			\"skipEmptyBuckets\": \"false\"\r\n		},\r\n		\"resultFormat\": \"object\"\r\n	},\r\n	\"resultKey\": \"\",\r\n	\"topic\": \"TOP-URLS-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:01:44', '', '1', '1629948000000', '1629948300000');
+INSERT INTO `xxl_job_info` VALUES ('45', '3', '0 0/5 * * * ?', 'Traffic-Top-Website-Domain', '2020-04-26 11:18:26', '2021-01-02 15:33:03', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n		\"query\": \"(SELECT domain,sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num,sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM website_domain_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND domain != \'\' GROUP BY domain ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT domain,sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num,sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM website_domain_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND domain != \'\' GROUP BY domain ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT domain,sum(session_num) AS session_num, sum(c2s_byte_num) AS c2s_byte_num, sum(s2c_byte_num) AS s2c_byte_num, sum(c2s_pkt_num) AS c2s_pkt_num,sum(s2c_pkt_num) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM website_domain_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND domain != \'\' GROUP BY domain ORDER BY session_num DESC LIMIT 1000)\",\r\n		\"context\": {\r\n			\"skipEmptyBuckets\": \"false\"\r\n		},\r\n		\"resultFormat\": \"object\"\r\n	},\r\n	\"resultKey\": \"\",\r\n	\"topic\": \"TOP-WEBSITE-DOMAIN-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:18:26', '', '1', '1629948000000', '1629948300000');
+INSERT INTO `xxl_job_info` VALUES ('46', '3', '0 0/5 * * * ?', 'Traffic-Top-User', '2020-04-26 11:23:08', '2021-01-02 15:32:34', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n		\"query\": \"(SELECT common_subscriber_id as subscriber_id, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num,sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM user_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_subscriber_id != \'\' GROUP BY common_subscriber_id ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_subscriber_id as subscriber_id,sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM user_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_subscriber_id != \'\' GROUP BY common_subscriber_id ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_subscriber_id as subscriber_id,sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM user_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_subscriber_id != \'\' GROUP BY common_subscriber_id ORDER BY session_num DESC LIMIT 1000)\",\r\n		\"context\": {\r\n			\"skipEmptyBuckets\": \"false\"\r\n		},\r\n		\"resultFormat\": \"object\"\r\n	},\r\n	\"resultKey\": \"\",\r\n	\"topic\": \"TOP-USER-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:23:08', '', '1', '1629948000000', '1629948300000');
+INSERT INTO `xxl_job_info` VALUES ('47', '3', '0 0/5 * * * ?', 'Traffic-Top-External-Host', '2020-04-26 11:32:41', '2021-01-02 15:32:02', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n		\"query\": \"(SELECT common_external_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_external_ip != \'\' GROUP BY common_external_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_external_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_external_ip != \'\' GROUP BY common_external_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_external_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_external_ip != \'\' GROUP BY common_external_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n		\"context\": {\r\n			\"skipEmptyBuckets\": \"false\"\r\n		},\r\n		\"resultFormat\": \"object\"\r\n	},\r\n	\"resultKey\": \"\",\r\n	\"topic\": \"TOP-EXTERNAL-HOST-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:32:41', '', '1', '1629948000000', '1629948300000');
+INSERT INTO `xxl_job_info` VALUES ('48', '3', '0 0/5 * * * ?', 'Traffic-Top-Internal-Host', '2020-04-26 11:38:57', '2021-01-02 15:31:13', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n		\"query\": \"(SELECT common_internal_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_internal_ip != \'\' GROUP BY common_internal_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_internal_ip AS source, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_internal_ip != \'\' GROUP BY common_internal_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_internal_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time, \'sessions\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND common_internal_ip != \'\' GROUP BY common_internal_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n		\"context\": {\r\n			\"skipEmptyBuckets\": \"false\"\r\n		},\r\n		\"resultFormat\": \"object\"\r\n	},\r\n	\"resultKey\": \"\",\r\n	\"topic\": \"TOP-INTERNAL-HOST-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-04-26 11:38:57', '', '1', '1629948000000', '1629948300000');
+INSERT INTO `xxl_job_info` VALUES ('58', '7', '0 0 0 1/1 * ? ', 'Setting Metrics Max Days', '2020-07-30 10:34:34', '2021-08-17 17:15:05', 'galaxy', '', 'FAILOVER', 'deleteReportAndMetricsDataJobHandler', '{\"maxdays\":60}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 10:34:34', '', '1', '1629907200000', '1629993600000');
+INSERT INTO `xxl_job_info` VALUES ('59', '7', '0 0 0 1 * ?', 'Clear Metrics', '2020-07-30 11:32:08', '2021-08-17 17:16:35', 'galaxy', '', 'FAILOVER', 'deleteAllReportAndMetricsDataJobHandler', '{\"maxdays\":2}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 11:32:08', '', '0', '0', '0');
+INSERT INTO `xxl_job_info` VALUES ('62', '7', '0 0 0 1/1 * ? ', 'Setting Files Max Days', '2020-07-30 11:59:30', '2021-08-17 17:15:26', 'galaxy', '', 'FAILOVER', 'deleteFilesJobHandler', '{\"maxdays\":60}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 11:59:30', '', '1', '1629907200000', '1629993600000');
+INSERT INTO `xxl_job_info` VALUES ('63', '7', '0 0 0 1 * ?', 'Clear Files', '2020-07-30 11:59:43', '2021-08-17 17:16:06', 'galaxy', '', 'FAILOVER', 'deleteAllFilesJobHandler', '{\"maxdays\":730}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 11:59:43', '', '0', '0', '0');
+INSERT INTO `xxl_job_info` VALUES ('64', '7', '0 0 0 1 * ?', 'Clear Traffic Logs', '2020-07-30 13:47:25', '2021-08-17 17:15:48', 'galaxy', '', 'FAILOVER', 'deleteAllTrafficDataJobHandler', '{\"maxdays\":3}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 13:47:25', '', '0', '0', '0');
+INSERT INTO `xxl_job_info` VALUES ('65', '7', '0 0 0 1/1 * ? ', 'Setting Traffic Logs Max Days', '2020-07-30 13:47:38', '2021-08-17 17:14:17', 'galaxy', '', 'FAILOVER', 'deleteTrafficDataJobHandler', '{\"maxdays\":60}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-07-30 13:47:38', '', '1', '1629907200000', '1629993600000');
+INSERT INTO `xxl_job_info` VALUES ('66', '3', '0 0/5 * * * ?', 'Traffic-Top-Client-Ip', '2020-09-23 14:43:56', '2021-01-02 15:30:48', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n		\"query\": \"(SELECT common_client_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_client_ip AS source, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_client_ip AS source, sum( session_num ) AS session_num,sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num, sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time, \'sessions\' as order_by FROM client_internal_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_client_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n		\"context\": {\r\n			\"skipEmptyBuckets\": \"false\"\r\n		},\r\n		\"resultFormat\": \"object\"\r\n	},\r\n	\"resultKey\": \"\",\r\n	\"topic\": \"TOP-CLIENT-IP-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-09-23 14:43:56', '', '1', '1629948000000', '1629948300000');
+INSERT INTO `xxl_job_info` VALUES ('67', '3', '0 0/5 * * * ?', 'Traffic-Top-Server-Ip', '2020-09-23 14:46:37', '2021-01-02 15:30:21', 'galaxy', '', 'FAILOVER', 'httpToKafkaJobHandler', '{\r\n	\"url\": \"http://{{ gateway_keepalive_host }}:8089/druid/v2/sql\",\r\n	\"method\": \"post\",\r\n	\"requestBody\": {\r\n		\"query\": \"(SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num,TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'packets\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY c2s_pkt_num+s2c_pkt_num DESC LIMIT 1000) UNION ALL (SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num,sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'bytes\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY c2s_byte_num+s2c_byte_num DESC LIMIT 1000) UNION ALL (SELECT common_server_ip AS destination, sum( session_num ) AS session_num, sum( c2s_byte_num ) AS c2s_byte_num, sum( s2c_byte_num ) AS s2c_byte_num,sum( c2s_pkt_num ) AS c2s_pkt_num, sum( s2c_pkt_num ) AS s2c_pkt_num, TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') as stat_time,\'sessions\' as order_by FROM server_external_ip_hot_log WHERE __time >=  TIME_SHIFT(TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\'),\'PT5M\',-1) AND __time < TIME_FLOOR(CURRENT_TIMESTAMP,\'PT5M\') AND (common_l4_protocol = \'IPv6_TCP\' OR common_l4_protocol = \'IPv4_TCP\') GROUP BY common_server_ip ORDER BY session_num DESC LIMIT 1000)\",\r\n		\"context\": {\r\n			\"skipEmptyBuckets\": \"false\"\r\n		},\r\n		\"resultFormat\": \"object\"\r\n	},\r\n	\"resultKey\": \"\",\r\n	\"topic\": \"TOP-SERVER-IP-LOG\"\r\n}', 'SERIAL_EXECUTION', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2020-09-23 14:46:37', '', '1', '1629948000000', '1629948300000');
+INSERT INTO `xxl_job_info` VALUES ('68', '7', '0 0 0 1/1 * ? ', 'Setting Cache Metrics Max Days', '2020-09-25 19:29:09', '2021-08-17 17:13:58', 'galaxy', '', 'FAILOVER', 'deleteDruidHotLogJobHandler', '{\"maxdays\":1}', 'DISCARD_LATER', '0', '2', 'BEAN', '', 'GLUE代码初始化', '2020-09-25 19:29:09', '', '1', '1629907200000', '1629993600000');
+INSERT INTO `xxl_job_info` VALUES ('86', '6', '0 0 1 * * ?', 'Compact-With-Day-Job', '2021-07-21 14:13:57', '2021-08-17 16:43:30', 'galaxy', '', 'FAILOVER', 'druidCompactSegmentJobHandler', '{\r\n\"dataSource\":\"top_urls_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_website_domain_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_client_ip_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_server_ip_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_external_host_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"top_internal_host_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"security_event_hits_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"traffic_protocol_stat_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"traffic_metrics_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n};\r\n{\r\n\"dataSource\":\"traffic_protocol_stat_log\",\r\n \"numOfDay\":1,\r\n \"segmentGranularity\":\"DAY\"\r\n}', 'DISCARD_LATER', '0', '0', 'BEAN', '', 'GLUE代码初始化', '2021-07-21 14:13:57', '', '1', '1629910800000', '1629997200000');
+
+
+
 
 -- ----------------------------
 -- Table structure for `xxl_job_lock`
@@ -89,8 +98,8 @@ INSERT INTO `xxl_job_info` VALUES ('68', '3', '0 0 0 1/1 * ? ', '设置Druid hot
 DROP TABLE IF EXISTS `xxl_job_lock`;
 CREATE TABLE `xxl_job_lock` (
   `lock_name` varchar(50) NOT NULL COMMENT '锁名称',
-  PRIMARY KEY (`lock_name`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+  PRIMARY KEY (`lock_name`) USING BTREE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
 -- ----------------------------
 -- Records of xxl_job_lock
@@ -117,10 +126,10 @@ CREATE TABLE `xxl_job_log` (
   `handle_code` int(11) NOT NULL COMMENT '执行-状态',
   `handle_msg` text DEFAULT NULL COMMENT '执行-日志',
   `alarm_status` tinyint(4) NOT NULL DEFAULT 0 COMMENT '告警状态：0-默认、1-无需告警、2-告警成功、3-告警失败',
-  PRIMARY KEY (`id`),
-  KEY `I_trigger_time` (`trigger_time`),
-  KEY `I_handle_code` (`handle_code`)
-) ENGINE=InnoDB AUTO_INCREMENT=1715972 DEFAULT CHARSET=utf8mb4;
+  PRIMARY KEY (`id`) USING BTREE,
+  KEY `I_trigger_time` (`trigger_time`) USING BTREE,
+  KEY `I_handle_code` (`handle_code`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=2077219 DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
 
 -- ----------------------------
@@ -133,9 +142,9 @@ CREATE TABLE `xxl_job_log_report` (
   `running_count` int(11) NOT NULL DEFAULT 0 COMMENT '运行中-日志数量',
   `suc_count` int(11) NOT NULL DEFAULT 0 COMMENT '执行成功-日志数量',
   `fail_count` int(11) NOT NULL DEFAULT 0 COMMENT '执行失败-日志数量',
-  PRIMARY KEY (`id`),
+  PRIMARY KEY (`id`) USING BTREE,
   UNIQUE KEY `i_trigger_day` (`trigger_day`) USING BTREE
-) ENGINE=InnoDB AUTO_INCREMENT=181 DEFAULT CHARSET=utf8mb4;
+) ENGINE=InnoDB AUTO_INCREMENT=783 DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
 -- ----------------------------
 
@@ -151,8 +160,8 @@ CREATE TABLE `xxl_job_logglue` (
   `glue_remark` varchar(128) NOT NULL COMMENT 'GLUE备注',
   `add_time` datetime DEFAULT NULL,
   `update_time` datetime DEFAULT NULL,
-  PRIMARY KEY (`id`)
-) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4;
+  PRIMARY KEY (`id`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
 -- ----------------------------
 -- Records of xxl_job_logglue
@@ -168,9 +177,9 @@ CREATE TABLE `xxl_job_registry` (
   `registry_key` varchar(255) NOT NULL,
   `registry_value` varchar(255) NOT NULL,
   `update_time` datetime DEFAULT NULL,
-  PRIMARY KEY (`id`),
-  KEY `i_g_k_v` (`registry_group`,`registry_key`,`registry_value`)
-) ENGINE=InnoDB AUTO_INCREMENT=235 DEFAULT CHARSET=utf8mb4;
+  PRIMARY KEY (`id`) USING BTREE,
+  KEY `i_g_k_v` (`registry_group`,`registry_key`,`registry_value`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=274 DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
 -- ----------------------------
 -- Table structure for `xxl_job_user`
@@ -182,9 +191,9 @@ CREATE TABLE `xxl_job_user` (
   `password` varchar(50) NOT NULL COMMENT '密码',
   `role` tinyint(4) NOT NULL COMMENT '角色：0-普通用户、1-管理员',
   `permission` varchar(255) DEFAULT NULL COMMENT '权限：执行器ID列表，多个逗号分割',
-  PRIMARY KEY (`id`),
+  PRIMARY KEY (`id`) USING BTREE,
   UNIQUE KEY `i_username` (`username`) USING BTREE
-) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4;
+) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
 -- ----------------------------
 -- Records of xxl_job_user
diff --git a/parcels/roles/services/galaxy-job-service/vars/main.yml b/parcels/roles/services/galaxy-job-service/vars/main.yml
index e55c12b..e602256 100644
--- a/parcels/roles/services/galaxy-job-service/vars/main.yml
+++ b/parcels/roles/services/galaxy-job-service/vars/main.yml
@@ -1,5 +1,5 @@
 #离线模式下使用:bifang-api的docker镜像文件名称,在../file中的文件名称
-job_image_tar_name: galaxy-job-executor-v1.3.210413-rc1.tar
+job_image_tar_name: galaxy-job-executor-v1.3.210716.tar
 admin_image_tar_name: galaxy-job-admin-v1.3.20210408.tar
 
 ##########################公共属性#############################
@@ -9,7 +9,7 @@ job_image_name: galaxy-job-executor
 admin_image_name: galaxy-job-admin
 
 #{{ image_tar_name }}的镜像版本号,或者{{ docker_registry_image_and_tag }}中的镜像版本号
-job_image_tag_name: v1.3.210413-rc1
+job_image_tag_name: v1.3.210716
 admin_image_tag_name: v1.3.20210408
 
 #{{ image_tar_name }}的镜像,或者{{ docker_registry_image_and_tag }}中的镜像启动后的容器名称
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/ck-filter.json b/parcels/roles/services/galaxy-qgw-service/files/config/ck-filter.json
index f6f7ad6..ebf0e6c 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/ck-filter.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/ck-filter.json
@@ -15,9 +15,13 @@
       "name":"@common_filter",
       "value": [
         "common_log_id=1153021139190754263",
-        "common_client_ip='36.189.226.21'",
+        "common_client_ip='118.180.48.74'",
+        "common_client_ip='120.242.132.200'",
         "common_internal_ip='223.116.37.192'",
         "common_server_ip='8.8.8.8'",
+        "common_server_ip='114.114.114.114'",
+        "common_server_ip!='114.114.114.114'",
+        "common_server_ip='120.239.72.226'",
         "common_external_ip='111.10.53.14'",
         "common_client_port=52607",
         "common_server_port=443",
@@ -31,40 +35,64 @@
         "common_stream_trace_id=1153021139190754263",
         "common_tcp_client_isn=2857077935",
         "common_tcp_server_isn=0",
-        "http_domain='microsoft.com'",
+        "http_domain='qq.com'",
+        "http_domain!='qq.com'",
+        "http_domain='yunser.com'",
         "mail_account='abc@xx.com'",
         "mail_subject='test'",
         "dns_qname='qbwup.imtt.qq.com'",
-        "ssl_sni='note.youdao.com'",
+        "ssl_sni='mmbiz.qpic.cn'",
+        "ssl_sni='openai.qq.com'",
         "ssl_con_latency_ms>100",
         "ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1'",
         "common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8'",
         "common_server_ip='111.10.53.14' and common_server_port=443",
+        "common_server_ip like '120.239%'",
+        "common_server_ip not like '120.239%'",
+        "common_server_ip like '%114.114%'",
         "mail_account like 'abc@%'",
         "http_domain like '%baidu.com%'",
-        "ssl_sni like '%youdao.com'",
-        "common_client_ip in ('36.189.226.21','111.10.53.14')",
+        "ssl_sni like '%google.com'",
+        "http_domain like 'baidu%'",
+        "http_domain like '%baidu.com%'",
+        "common_client_ip in ('120.239.72.226','114.114.114.114')",
+        "common_client_ip not in ('120.239.72.226','114.114.114.114')",
+        "common_server_ip='116.177.248.126' and notEmpty(http_domain)",
+        "common_server_ip='116.177.248.126' and common_client_ip='120.242.132.200'",
+        "common_server_ip='116.177.248.126' and common_stream_trace_id=1153021139190754263",
+        "common_client_ip='120.242.132.200' and common_server_ip='116.177.248.126'",
+        "http_domain='qq.com' or common_server_ip='120.239.72.226'",
         "common_server_port not in (80,443)",
-        "notEmpty(http_domain)",
-        "http_domain not like '%microsoft.com'"
+        "http_domain not like '%qq.com'"
       ]
     },
     {
         "name":"@index_filter",
         "value": [
           "common_log_id=1153021139190754263",
-          "common_client_ip='36.189.226.21'",
-          "common_server_ip='8.8.8.8'",
-          "common_sled_ip='%192.168%'",
-          "common_stream_trace_id=1153021139190754263",
-          "http_domain='microsoft.com'",
-          "ssl_sni='note.youdao.com'",
+          "common_client_ip='118.180.48.74'",
+          "common_client_ip='120.242.132.200'",
+          "common_server_ip='114.114.114.114'",
+          "common_server_ip!='114.114.114.114'",
+          "common_server_ip='120.239.72.226'",
+          "http_domain='qq.com'",
+          "http_domain!='qq.com'",
+          "http_domain='yunser.com'",
+          "ssl_sni='mmbiz.qpic.cn'",
+          "ssl_sni='openai.qq.com'",
+          "common_server_ip like '120.239%'",
+          "common_server_ip not like '120.239%'",
+          "common_server_ip like '%114.114%'",
           "common_subscriber_id='%test%'",
+          "http_domain like 'baidu%'",
           "http_domain like '%baidu.com%'",
-          "ssl_sni like '%youdao.com'",
-          "common_client_ip in ('36.189.226.21','111.10.53.14')",
-          "notEmpty(http_domain)",
-          "http_domain not like '%microsoft.com'"
+          "common_client_ip in ('120.239.72.226','114.114.114.114')",
+          "common_client_ip not in ('120.239.72.226','114.114.114.114')",
+          "common_server_ip='116.177.248.126' and notEmpty(http_domain)",
+          "common_server_ip='116.177.248.126' and common_client_ip='120.242.132.200'",
+          "common_server_ip='116.177.248.126' and common_stream_trace_id=1153021139190754263",
+          "common_client_ip='120.242.132.200' and common_server_ip='116.177.248.126'",
+          "http_domain='qq.com' or common_server_ip='120.239.72.226'"
         ]
     }
   ]
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/ck-queries-template.sql b/parcels/roles/services/galaxy-qgw-service/files/config/ck-queries-template.sql
index c867da7..68a2aaa 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/ck-queries-template.sql
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/ck-queries-template.sql
@@ -24,99 +24,97 @@ SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , co
 SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time DESC LIMIT 30
 --Q13.Default Field Query by Domain (sub query by log id with Index Table)
 SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time DESC LIMIT 30
---Q14.Default Field Query by Subscriber ID (sub query by log id with Index Table)
-SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time DESC LIMIT 30
---Q15.All Fields Query by Client IP (sub query by log id with index Table)
+--Q14.All Fields Query by Client IP (sub query by log id with index Table)
 SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time desc LIMIT 30
---Q16.All Fields Query by Server IP(sub query by log id with index Table)
+--Q15.All Fields Query by Server IP(sub query by log id with index Table)
 SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time desc LIMIT 30
---Q17.All Fields Query by Domain(sub query by log id with index Table)
+--Q16.All Fields Query by Domain(sub query by log id with index Table)
 SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time desc LIMIT 30
---Q18.All Fields Query by Subscriber ID(sub query by log id with index Table)
-SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time desc LIMIT 30
---Q19.Session Logs Sent to Database Trend(Time Grain 5 minute)
+--Q17.Session Logs Sent to Database Trend(Time Grain 5 minute)
 SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", count(common_log_id) AS "logs" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ) ) GROUP BY "Receive Time" LIMIT 10000
---Q20.Traffic Bandwidth Trend(Time Grain 30 second)
+--Q18.Traffic Bandwidth Trend(Time Grain 30 second)
 SELECT toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 30 SECOND)))) AS stat_time, sum(common_c2s_byte_num) AS bytes_sent, sum(common_s2c_byte_num) AS bytes_received, sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, sum(common_c2s_pkt_num + common_s2c_pkt_num) AS packets, sum(common_sessions) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) GROUP BY stat_time ORDER BY stat_time ASC LIMIT 10000
---Q21.Log Tend by Type (Time Grain 5 minute)
+--Q19.Log Tend by Type (Time Grain 5 minute)
 SELECT toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE)))) AS stat_time, common_schema_type AS type, sum(common_sessions) AS sessions, sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, sum(common_c2s_pkt_num + common_s2c_pkt_num) AS packets FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) GROUP BY stat_time, common_schema_type ORDER BY stat_time ASC LIMIT 10000
---Q22.Traffic Metrics Analytic
+--Q20.Traffic Metrics Analytic
 SELECT round(sum(common_s2c_byte_num) * 8 / 300,2) AS trafficInBits, round(sum(common_c2s_byte_num) * 8 / 300,2) AS trafficOutBits, round(sum(common_s2c_byte_num + common_c2s_byte_num) * 8 / 300,2) AS trafficTotalBits, round(sum(common_s2c_pkt_num) / 300,2) AS trafficInPackets, round(sum(common_c2s_pkt_num) / 300,2) AS trafficOutPackets, round(sum(common_s2c_pkt_num + common_c2s_pkt_num) / 300,2) AS trafficTotalPackets, round(sum(common_sessions) / 300,2) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end)
---Q23.Traffic Endpoints Metrics Trend(Time Grain 5 minute)
+--Q21.Traffic Endpoints Metrics Trend(Time Grain 5 minute)
 SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", uniq(common_internal_ip) AS "Unique Internal IP", uniq(common_external_ip) AS "Unique External IP", uniq(common_subscriber_id) AS "Unique Subscriber ID", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Receive Time" LIMIT 10000
---Q24.Endpoint Unique Num by L4 Protocol
+--Q22.Endpoint Unique Num by L4 Protocol
 SELECT 'all' AS type, uniq(common_client_ip) AS client_ips, uniq(common_internal_ip) AS internal_ips, uniq(common_server_ip) AS server_ips, uniq(common_external_ip) AS external_ips, uniq(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) UNION ALL SELECT 'tcp' AS type, uniq(common_client_ip) AS client_ips, uniq(common_internal_ip) AS internal_ips, uniq(common_server_ip) AS server_ips, uniq(common_external_ip) AS external_ips, uniq(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) UNION ALL SELECT 'UDP' AS type, uniq(common_client_ip) AS client_ips, uniq(common_internal_ip) AS internal_ips, uniq(common_server_ip) AS server_ips, uniq(common_external_ip) AS external_ips, uniq(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND common_l4_protocol IN ( 'IPv4_UDP', 'IPv6_UDP' )
---Q25.One-sided Connection Trend(Time Grain 5 minute)
+--Q23.One-sided Connection Trend(Time Grain 5 minute)
 SELECT toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE)))) AS stat_time, (CASE WHEN common_stream_dir = 1 THEN 'c2s' WHEN common_stream_dir = 2 THEN 's2c' WHEN common_stream_dir = 3 THEN 'double' ELSE 'None' END) AS type, sum(common_sessions) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) GROUP BY stat_time, common_stream_dir ORDER BY stat_time ASC LIMIT 10000
---Q26. Estimated One-sided Sessions with Bandwidth
+--Q24. Estimated One-sided Sessions with Bandwidth
 SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", sum(common_sessions) AS "sessions", sum(if(common_stream_dir <> 3, common_sessions, 0)) AS "one_side_sessions", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes", round(one_side_sessions / sessions, 2) AS one_side_percent FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Receive Time" LIMIT 10000
---Q27.Estimated TCP Sequence Gap Loss
+--Q25.Estimated TCP Sequence Gap Loss
 SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", sum(common_c2s_byte_num + common_s2c_byte_num) AS "bytes", sum(common_c2s_tcp_lostlen + common_s2c_tcp_lostlen) AS "gap_loss_bytes", round(gap_loss_bytes / bytes, 2) AS gap_loss_percent FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) ) GROUP BY "Receive Time" LIMIT 10000
---Q28.Top30 Server IP by Bytes
+--Q26.Top30 Server IP by Bytes
 SELECT "server_ip" AS "server_ip" , SUM(coalesce("bytes",0)) AS "bytes" , SUM(coalesce("bytes_sent",0)) AS "Sent" , SUM(coalesce("bytes_received",0)) AS "Received" , SUM(coalesce("sessions",0)) AS "sessions" FROM ( SELECT SUM(coalesce(common_c2s_byte_num,0)) AS "bytes_sent" , SUM(coalesce(common_s2c_byte_num,0)) AS "bytes_received" , SUM(common_c2s_byte_num+common_s2c_byte_num) AS "bytes" , SUM(coalesce(common_sessions,0)) AS "sessions" , common_server_ip AS "server_ip" FROM connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty( common_server_ip) ) GROUP BY "server_ip" ORDER BY "bytes" desc ) GROUP BY "server_ip" ORDER BY "bytes" desc LIMIT 30
---Q29.Top30 Client IP by Sessions
+--Q27.Top30 Client IP by Sessions
 SELECT common_client_ip , COUNT(*) AS sessions FROM connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) GROUP BY common_client_ip ORDER BY sessions desc LIMIT 0,30
---Q30.Top30 TCP Server Ports by Sessions
+--Q28.Top30 TCP Server Ports by Sessions
 SELECT "Server Port" AS "Server Port", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT common_server_port AS "Server Port", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) ) GROUP BY "Server Port" LIMIT 1048576) GROUP BY "Server Port" ORDER BY "Sessions" DESC LIMIT 30
---Q31.Top30 Domian by Bytes
+--Q29.Top30 Domian by Bytes
 SELECT "domain" AS "Website Domain" , SUM(coalesce("bytes",0)) AS "Throughput" FROM ( SELECT SUM(coalesce(common_c2s_byte_num,0)) AS "bytes_sent" , SUM(coalesce(common_s2c_byte_num,0)) AS "bytes_received" , SUM(coalesce(common_c2s_byte_num+common_s2c_byte_num,0)) AS "bytes" , http_domain AS "domain" FROM connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty( http_domain) ) GROUP BY "domain" ORDER BY "bytes" desc ) GROUP BY "domain" ORDER BY "Throughput" desc LIMIT 30
---Q32.Top30 Endpoint Devices by Bandwidth
+--Q30.Top30 Endpoint Devices by Bandwidth
 SELECT "device_id" AS "device_id", sum(coalesce("bytes", 0)) AS "bytes", sum(coalesce("bytes_sent", 0)) AS "Sent", sum(coalesce("bytes_received", 0)) AS "Received" FROM (SELECT sum(coalesce(common_c2s_byte_num, 0)) AS "bytes_sent", sum(coalesce(common_s2c_byte_num, 0)) AS "bytes_received", sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, common_device_id AS "device_id" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "device_id" ORDER BY "bytes" DESC LIMIT 1048576) GROUP BY "device_id" ORDER BY "bytes" DESC LIMIT 30
---Q33.Top30 Domain by Unique Client IP
+--Q31.Top30 Domain by Unique Client IP
 SELECT "Http.Domain" AS "Http.Domain", sum(coalesce("Client IP", 0)) AS "Client IP" FROM (SELECT http_domain AS "Http.Domain", uniq(common_client_ip) AS "Client IP" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) ) GROUP BY "Http.Domain" ORDER BY "Client IP" DESC LIMIT 1048576) GROUP BY "Http.Domain" ORDER BY "Client IP" DESC LIMIT 30
---Q34.Top100 Most Time Consuming Domains
+--Q32.Top100 Most Time Consuming Domains
 SELECT "Domain" AS "Domain", avg(coalesce("Avg Establish Latency(ms)", 0)) AS "Avg Establish Latency(ms)" FROM (SELECT http_domain AS "Domain", avg(coalesce(common_establish_latency_ms, 0)) AS "Avg Establish Latency(ms)" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) ) GROUP BY "Domain" LIMIT 1048576) GROUP BY "Domain" ORDER BY "Avg Establish Latency(ms)" DESC LIMIT 100
---Q35.Top30 Sources by Sessions
+--Q33.Top30 Sources by Sessions
 SELECT "source" AS "source", sum(coalesce("sessions", 0)) AS "sessions" FROM (SELECT coalesce(nullif(common_subscriber_id, ''), nullif(common_client_ip, '')) AS "source", sum(coalesce(common_sessions, 0)) AS "sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "source" ORDER BY "sessions" DESC LIMIT 1048576) GROUP BY "source" ORDER BY "sessions" DESC LIMIT 30
---Q36.Top30 Destinations by Sessions
+--Q34.Top30 Destinations by Sessions
 SELECT "destination" AS "destination", sum(coalesce("sessions", 0)) AS "sessions" FROM (SELECT coalesce(nullif(http_domain, ''), nullif(common_server_ip, '')) AS "destination", sum(coalesce(common_sessions, 0)) AS "sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "destination" ORDER BY "sessions" DESC LIMIT 1048576) GROUP BY "destination" ORDER BY "sessions" DESC LIMIT 30
---Q37.Top30 Destination Regions by Bandwidth
+--Q35.Top30 Destination Regions by Bandwidth
 SELECT "server_location" AS "server_location", sum(coalesce("bytes", 0)) AS "bytes", sum(coalesce("bytes_sent", 0)) AS "Sent", sum(coalesce("bytes_received", 0)) AS "Received" FROM (SELECT arrayElement(splitByString(',', common_server_location), length(splitByString(',', common_server_location))) AS "server_location", sum(coalesce(common_c2s_byte_num, 0)) AS "bytes_sent", sum(coalesce(common_s2c_byte_num, 0)) AS "bytes_received", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "bytes", sum(coalesce(common_sessions, 0)) AS "sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "server_location" ORDER BY "bytes" DESC LIMIT 1048576) GROUP BY "server_location" ORDER BY "bytes" DESC LIMIT 30
---Q38.Top30 URLS by Sessions
+--Q36.Top30 URLS by Sessions
 SELECT "Http URL" AS "Http URL", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT http_url AS "Http URL", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Http URL" LIMIT 1048576) GROUP BY "Http URL" ORDER BY "Sessions" DESC LIMIT 30
---Q39.Top30 Destination Transmission APP by Bandwidth
+--Q37.Top30 Destination Transmission APP by Bandwidth
 SELECT "server_ip" AS "server_ip", groupUniqArray(coalesce("trans_app", 0)) AS "trans_app", sum(coalesce("bytes", 0)) AS "bytes", sum(coalesce("bytes_sent", 0)) AS "Sent", sum(coalesce("bytes_received", 0)) AS "Received" FROM (SELECT sum(coalesce(common_c2s_byte_num, 0)) AS "bytes_sent", sum(coalesce(common_s2c_byte_num, 0)) AS "bytes_received", sum(common_c2s_byte_num + common_s2c_byte_num) AS "bytes", groupUniqArray(concat(common_l4_protocol, '/', toString(common_server_port))) AS "trans_app", common_server_ip AS "server_ip" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(common_server_ip) ) GROUP BY "server_ip" ORDER BY "bytes" DESC LIMIT 1048576) GROUP BY "server_ip" ORDER BY "bytes" DESC LIMIT 30
---Q40.Browsing Users by Website domains and Sessions
+--Q38.Browsing Users by Website domains and Sessions
 SELECT "Subscriber ID" AS "Subscriber ID", "Http.Domain" AS "Http.Domain", sum(coalesce("sessions", 0)) AS "sessions" FROM (SELECT http_domain AS "Http.Domain", common_subscriber_id AS "Subscriber ID", sum(coalesce(common_sessions, 0)) AS "sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) AND notEmpty(common_subscriber_id) ) GROUP BY "Http.Domain", "Subscriber ID" ORDER BY "sessions" DESC LIMIT 1048576) GROUP BY "Subscriber ID", "Http.Domain" ORDER BY "sessions" DESC LIMIT 10000
---Q41.Top Domain and Server IP by Bytes Sent
+--Q39.Top Domain and Server IP by Bytes Sent
 SELECT "Http.Domain" AS "Http.Domain" , "Server IP" AS "Server IP" , SUM(coalesce("Bytes Sent",0)) AS "Bytes Sent" FROM ( SELECT common_server_ip AS "Server IP" , http_domain AS "Http.Domain" , SUM(coalesce(common_c2s_byte_num+common_s2c_byte_num,0)) AS "Bytes" , SUM(coalesce(common_c2s_byte_num,0)) AS "Bytes Sent" , SUM(coalesce(common_s2c_byte_num,0)) AS "Bytes Received" FROM connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty( http_domain) ) GROUP BY "Server IP" , "Http.Domain" ORDER BY "Bytes" desc LIMIT 1048576 ) GROUP BY "Http.Domain" , "Server IP" ORDER BY "Bytes Sent" desc LIMIT 10000
---Q42.Top30 Website Domains by Client IP and Sessions
+--Q40.Top30 Website Domains by Client IP and Sessions
 SELECT "Http.Domain" AS "Http.Domain", "Client IP" AS "Client IP", sum(coalesce("sessions", 0)) AS "sessions" FROM (SELECT common_client_ip AS "Client IP", http_domain AS "Http.Domain", sum(coalesce(common_sessions, 0)) AS "sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) ) GROUP BY "Client IP", "Http.Domain" ORDER BY "sessions" DESC LIMIT 1048576) GROUP BY "Http.Domain", "Client IP" ORDER BY "sessions" DESC LIMIT 10000
---Q43.Domain is Accessed by Unique Client IP Trend(bytes Time Grain 5 minute)
+--Q41.Domain is Accessed by Unique Client IP Trend(bytes Time Grain 5 minute)
 SELECT toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) AS _time , http_domain AS Domain, COUNT(DISTINCT(common_client_ip)) AS nums FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND notEmpty(http_domain) AND http_domain IN ( SELECT http_domain FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND notEmpty(http_domain) GROUP BY http_domain ORDER BY SUM(common_s2c_byte_num+common_c2s_byte_num) DESC LIMIT 5 ) GROUP BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) , http_domain ORDER BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) DESC LIMIT 10000
---Q44. Domain is Accessed by Unique Client IP Trend(sessions,Time Grain 5 minute)
+--Q42. Domain is Accessed by Unique Client IP Trend(sessions,Time Grain 5 minute)
 SELECT toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),3600)*3600) AS stat_time , http_domain , uniq (common_client_ip) AS nums FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start)-604800 AND common_recv_time < toDateTime(@end) AND http_domain IN ( SELECT http_domain FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND notEmpty(http_domain) GROUP BY http_domain ORDER BY COUNT(*) desc LIMIT 5 ) group by toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 3600)*3600), http_domain ORDER BY stat_time desc LIMIT 10000
---Q45.Bandwidth Trend with Device ID(Time Grain 5 minute)
+--Q43.Bandwidth Trend with Device ID(Time Grain 5 minute)
 SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", common_device_id AS "Device ID", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Receive Time", "Device ID" LIMIT 10000
---Q46.Internal IP by Sled IP and Sessions
+--Q44.Internal IP by Sled IP and Sessions
 SELECT "Internal IP" AS "Internal IP", "Sled IP" AS "Sled IP", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT common_sled_ip AS "Sled IP", common_internal_ip AS "Internal IP", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Sled IP", "Internal IP" LIMIT 1048576) GROUP BY "Internal IP", "Sled IP" ORDER BY "Sessions" DESC LIMIT 10000
---Q47.Bandwidth Trend with Internal IP (Time Grain 5 minute)
+--Q45.Bandwidth Trend with Internal IP (Time Grain 5 minute)
 SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS "Packets", sum(coalesce(common_sessions, 0)) AS "New Sessions", sum(coalesce(common_c2s_byte_num, 0)) AS "Bytes Sent", sum(coalesce(common_s2c_byte_num, 0)) AS "Bytes Received", sum(coalesce(common_c2s_pkt_num, 0)) AS "Packets Sent", sum(coalesce(common_s2c_pkt_num, 0)) AS "Packets Received" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) AND @common_filter ) GROUP BY "Receive Time" LIMIT 10000
---Q48.Top30 Domains Detail with Internal IP
+--Q46.Top30 Domains Detail with Internal IP
 SELECT "Domain" AS "Domain", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT http_domain AS "Domain", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) AND @common_filter ) AND ( notEmpty(http_domain) ) GROUP BY "Domain" LIMIT 1048576) GROUP BY "Domain" ORDER BY "Sessions" DESC LIMIT 30
---Q49.Top30 URLS Detail with Internal IP
+--Q47.Top30 URLS Detail with Internal IP
 SELECT "URL" AS "URL", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT http_url AS "URL", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) AND @common_filter ) AND ( notEmpty(http_url) ) GROUP BY "URL" LIMIT 1048576) GROUP BY "URL" ORDER BY "Sessions" DESC LIMIT 30
---Q50.Top Domains with Unique Client IP and Subscriber ID
+--Q48.Top Domains with Unique Client IP and Subscriber ID
 SELECT "Http.Domain" AS "Http.Domain", sum(coalesce("Unique Client IP", 0)) AS "Unique Client IP", sum(coalesce("Unique Subscriber ID", 0)) AS "Unique Subscriber ID" FROM (SELECT http_domain AS "Http.Domain", uniq(common_client_ip) AS "Unique Client IP", uniq(common_subscriber_id) AS "Unique Subscriber ID" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) ) GROUP BY "Http.Domain" LIMIT 1048576) GROUP BY "Http.Domain" ORDER BY "Unique Client IP" DESC LIMIT 100
---Q51.Top100 Domains by Packets sent
+--Q49.Top100 Domains by Packets sent
 SELECT "Http.Domain" AS "Http.Domain", sum(coalesce("Packets Sent", 0)) AS "Packets Sent" FROM (SELECT http_domain AS "Http.Domain", sum(coalesce(common_c2s_pkt_num, 0)) AS "Packets Sent" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Http.Domain" LIMIT 1048576) GROUP BY "Http.Domain" ORDER BY "Packets Sent" DESC LIMIT 100
---Q52.Internal and External asymmetric traffic
+--Q50.Internal and External asymmetric traffic
 SELECT "Internal IP" AS "Internal IP", "External IP" AS "External IP", "Sled IP" AS "Sled IP", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT common_sled_ip AS "Sled IP", common_external_ip AS "External IP", common_internal_ip AS "Internal IP", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes Sent+Bytes Received", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( common_stream_dir != 3 ) GROUP BY "Sled IP", "External IP", "Internal IP" LIMIT 1048576) GROUP BY "Internal IP", "External IP", "Sled IP" ORDER BY "Sessions" DESC LIMIT 500
---Q53.Client and Server ASN asymmetric traffic
+--Q51.Client and Server ASN asymmetric traffic
 SELECT "Client ASN" AS "Client ASN", "Server ASN" AS "Server ASN", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT common_server_asn AS "Server ASN", common_client_asn AS "Client ASN", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( common_stream_dir != 3 ) GROUP BY "Server ASN", "Client ASN" LIMIT 1048576) GROUP BY "Client ASN", "Server ASN" ORDER BY "Sessions" DESC LIMIT 500
---Q54.Top handshake latency by Website and Client IPs
+--Q52.Top handshake latency by Website and Client IPs
 SELECT "SSL.SNI" AS "SSL.SNI", "Client IP" AS "Client IP", avg(coalesce("Establish Latency(ms)", 0)) AS "Establish Latency(ms)" FROM (SELECT common_client_ip AS "Client IP", ssl_sni AS "SSL.SNI", avg(coalesce(common_establish_latency_ms, 0)) AS "Establish Latency(ms)" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Client IP", "SSL.SNI" LIMIT 1048576) GROUP BY "SSL.SNI", "Client IP" ORDER BY "Establish Latency(ms)" DESC LIMIT 500
---Q55.Domain Baidu.com Metrics
+--Q53.Domain Baidu.com Metrics
 select  FROM_UNIXTIME(min(common_recv_time)) as "First Seen" , FROM_UNIXTIME(max(common_recv_time)) as "Last Seen" ,  median(http_response_latency_ms) as "Server Processing Time Median(ms)", count(1) as Responses,any(common_server_location)  as Location from connection_record_log WHERE  common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end)  AND  http_domain='baidu.com'
---Q56.Domain baidu.com Drill down Client IP
+--Q54.Domain baidu.com Drill down Client IP
 select common_client_ip as "Client IP" , avg(common_establish_latency_ms) as "Establishing Time Mean(ms)", count(1) as Responses,any(common_client_location) as Location from connection_record_log where  common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end)  and http_domain='baidu.com' group by "Client IP" order by Responses desc limit 100
---Q57.Domain baidu.com Drill down Server IP
+--Q55.Domain baidu.com Drill down Server IP
 select common_server_ip as "Server IP" , avg(http_response_latency_ms) as "Server Processing Time Mean(ms)", count(1) as Responses,any(common_server_location) as Location from connection_record_log where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and http_domain='baidu.com' group by "Server IP" order by Responses desc limit 100
---Q58.Domain baidu.com Drill down URI
+--Q56.Domain baidu.com Drill down URI
 select http_url as "URI" , avg(http_response_latency_ms) as "Server Processing Time Mean(ms)", count(1) as Responses from connection_record_log where  common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and http_domain='baidu.com' group by "URI" order by Responses desc limit 100
---Q59.L7 Protocol Metrics
+--Q57.L7 Protocol Metrics
 select  common_l7_protocol as "Protocol" , uniq(common_client_ip) as "Clients" , uniq(common_server_ip) as "Servers", count(1) as Sessions,sum(common_c2s_byte_num+common_s2c_byte_num)  as bytes from connection_record_log where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and notEmpty(common_l7_protocol)  group by common_l7_protocol  order by bytes desc
---Q60.L7 Protocol SIP Drill down Client IP
+--Q58.L7 Protocol SIP Drill down Client IP
 select common_client_ip as "Client IP" , count(1) as Sessions,sum(common_c2s_byte_num) as "Bytes Out", sum(common_s2c_byte_num) as "Bytes In",any(common_client_location) as Location from connection_record_log where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and common_l7_protocol='SIP' group by "Client IP" order by Sessions desc limit 100
---Q61.L7 Protocol SIP Drill down Server IP
-select common_server_ip as "Server IP" , count(1) as Sessions,sum(common_c2s_byte_num) as "Bytes Out", sum(common_s2c_byte_num) as "Bytes In",any(common_server_location) as Location from connection_record_log where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and common_l7_protocol='SIP' group by "Server IP" order by Sessions desc limit 100
\ No newline at end of file
+--Q59.L7 Protocol SIP Drill down Server IP
+select common_server_ip as "Server IP" , count(1) as Sessions,sum(common_c2s_byte_num) as "Bytes Out", sum(common_s2c_byte_num) as "Bytes In",any(common_server_location) as Location from connection_record_log where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and common_l7_protocol='SIP' group by "Server IP" order by Sessions desc limit 100
+--Q60.Top5 Server IP keys with Unique Client IPs Trend (Grain 5 minute)
+SELECT toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) AS _time , common_server_ip AS server_ip, COUNT(DISTINCT(common_client_ip)) AS nums FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND common_server_ip IN ( SELECT common_server_ip FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end)  GROUP BY common_server_ip ORDER BY count(*) DESC LIMIT 5 ) GROUP BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) , server_ip ORDER BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) DESC LIMIT 10000
\ No newline at end of file
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log.json
index 795b433..423bf8b 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log.json
@@ -5,7 +5,7 @@
   "doc": {
     "primary_key": "common_log_id",
     "partition_key": "common_recv_time",
-    "index_table": "connection_record_log_common_client_ip,connection_record_log_common_server_ip,connection_record_log_common_subscriber_id,connection_record_log_http_domain",
+    "index_table": "connection_record_log_common_client_ip,connection_record_log_common_server_ip,connection_record_log_http_domain",
     "functions": {
       "aggregation": [
         {
@@ -358,7 +358,9 @@
           "common_s2c_byte_retrans",
           "common_first_ttl",
           "common_tcp_client_isn",
-          "common_tcp_server_isn"
+          "common_tcp_server_isn",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "other": [
           "common_address_type",
@@ -453,7 +455,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -543,6 +547,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "http_url",
           "http_host",
           "http_domain",
@@ -658,6 +664,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "mail_protocol_type",
           "mail_account",
           "mail_from_cmd",
@@ -765,6 +773,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "dns_message_id",
           "dns_qr",
           "dns_opcode",
@@ -872,6 +882,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "ssl_sni",
           "ssl_san",
           "ssl_cn",
@@ -978,6 +990,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "quic_version",
           "quic_sni",
           "quic_user_agent"
@@ -1071,6 +1085,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "ftp_account",
           "ftp_url",
           "ftp_content",
@@ -1165,6 +1181,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "bgp_type",
           "bgp_as_num",
           "bgp_route"
@@ -1259,6 +1277,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "sip_call_id",
           "sip_originator_description",
           "sip_responder_description",
@@ -1366,6 +1386,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "rtp_payload_type_c2s",
           "rtp_payload_type_s2c",
           "rtp_pcap_path",
@@ -1460,6 +1482,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "app_extra_info"
         ],
         "default_columns": [
@@ -2448,6 +2472,22 @@
       },
       "type": "long"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
     {
       "name": "http_url",
       "label": "HTTP.URL",
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_client_ip.json b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_client_ip.json
index e407d26..234e7d5 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_client_ip.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_client_ip.json
@@ -15,14 +15,6 @@
       "name": "common_recv_time",
       "type": "long"
     },
-    {
-      "name": "common_policy_id",
-      "type": "long"
-    },
-    {
-      "name": "common_action",
-      "type": "int"
-    },
     {
       "name": "common_server_ip",
       "type": "string"
@@ -47,6 +39,26 @@
       "name": "common_stream_trace_id",
       "type": "long"
     },
+    {
+      "name": "common_schema_type",
+      "type": "string"
+    },
+    {
+      "name": "common_client_port",
+      "type": "int"
+    },
+    {
+      "name": "common_server_port",
+      "type": "int"
+    },
+    {
+      "name": "common_app_label",
+      "type": "string"
+    },
+    {
+      "name": "common_direction",
+      "type": "int"
+    },
     {
       "name": "http_domain",
       "type": "string"
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_server_ip.json b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_server_ip.json
index a63ddd8..3024dc6 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_server_ip.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_server_ip.json
@@ -15,14 +15,6 @@
       "name": "common_recv_time",
       "type": "long"
     },
-    {
-      "name": "common_policy_id",
-      "type": "long"
-    },
-    {
-      "name": "common_action",
-      "type": "int"
-    },
     {
       "name": "common_server_ip",
       "type": "string"
@@ -47,6 +39,26 @@
       "name": "common_stream_trace_id",
       "type": "long"
     },
+    {
+      "name": "common_schema_type",
+      "type": "string"
+    },
+    {
+      "name": "common_client_port",
+      "type": "int"
+    },
+    {
+      "name": "common_server_port",
+      "type": "int"
+    },
+    {
+      "name": "common_app_label",
+      "type": "string"
+    },
+    {
+      "name": "common_direction",
+      "type": "int"
+    },
     {
       "name": "http_domain",
       "type": "string"
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_subscriber_id.json b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_subscriber_id.json
deleted file mode 100644
index 736f3f2..0000000
--- a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_common_subscriber_id.json
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  "type": "record",
-  "name": "connection_record_log_common_subscriber_id",
-  "namespace": "tsg_galaxy_v3",
-  "doc": {
-    "primary_key": "common_log_id",
-    "index_key": "common_subscriber_id"
-  },
-  "fields": [
-    {
-      "name": "common_log_id",
-      "type": "long"
-    },
-    {
-      "name": "common_recv_time",
-      "type": "long"
-    },
-    {
-      "name": "common_policy_id",
-      "type": "long"
-    },
-    {
-      "name": "common_action",
-      "type": "int"
-    },
-    {
-      "name": "common_server_ip",
-      "type": "string"
-    },
-    {
-      "name": "common_client_ip",
-      "type": "string"
-    },
-    {
-      "name": "common_sled_ip",
-      "type": "string"
-    },
-    {
-      "name": "common_entrance_id",
-      "type": "int"
-    },
-    {
-      "name": "common_subscriber_id",
-      "type": "string"
-    },
-    {
-      "name": "common_stream_trace_id",
-      "type": "long"
-    },
-    {
-      "name": "http_domain",
-      "type": "string"
-    },
-    {
-      "name": "ssl_sni",
-      "type": "string"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_http_domain.json b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_http_domain.json
index 2e25585..1289b50 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_http_domain.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/connection_record_log_http_domain.json
@@ -15,14 +15,6 @@
       "name": "common_recv_time",
       "type": "long"
     },
-    {
-      "name": "common_policy_id",
-      "type": "long"
-    },
-    {
-      "name": "common_action",
-      "type": "int"
-    },
     {
       "name": "common_server_ip",
       "type": "string"
@@ -47,6 +39,26 @@
       "name": "common_stream_trace_id",
       "type": "long"
     },
+    {
+      "name": "common_schema_type",
+      "type": "string"
+    },
+    {
+      "name": "common_client_port",
+      "type": "int"
+    },
+    {
+      "name": "common_server_port",
+      "type": "int"
+    },
+    {
+      "name": "common_app_label",
+      "type": "string"
+    },
+    {
+      "name": "common_direction",
+      "type": "int"
+    },
     {
       "name": "http_domain",
       "type": "string"
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/dos_event_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/dos_event_log.json
new file mode 100644
index 0000000..10fd1ac
--- /dev/null
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/dos_event_log.json
@@ -0,0 +1,344 @@
+{
+  "type": "record",
+  "name": "dos_event_log",
+  "namespace": "tsg_galaxy_v3",
+  "doc": {
+    "primary_key": "log_id",
+    "partition_key": "start_time",
+    "functions": {
+      "aggregation": [
+        {
+          "name": "COUNT",
+          "label": "COUNT",
+          "function": "count(expr)"
+        },
+        {
+          "name": "COUNT_DISTINCT",
+          "label": "COUNT_DISTINCT",
+          "function": "count(distinct expr)"
+        },
+        {
+          "name": "AVG",
+          "label": "AVG",
+          "function": "avg(expr)"
+        },
+        {
+          "name": "SUM",
+          "label": "SUM",
+          "function": "sum(expr)"
+        },
+        {
+          "name": "MAX",
+          "label": "MAX",
+          "function": "max(expr)"
+        },
+        {
+          "name": "MIN",
+          "label": "MIN",
+          "function": "min(expr)"
+        }
+      ],
+      "operator": [
+        {
+          "name": "=",
+          "label": "=",
+          "function": "expr = value"
+        },
+        {
+          "name": "!=",
+          "label": "!=",
+          "function": "expr != value"
+        },
+        {
+          "name": ">",
+          "label": ">",
+          "function": "expr > value"
+        },
+        {
+          "name": "<",
+          "label": "<",
+          "function": "expr < value"
+        },
+        {
+          "name": ">=",
+          "label": ">=",
+          "function": "expr >= value"
+        },
+        {
+          "name": "<=",
+          "label": "<=",
+          "function": "expr <= value"
+        },
+        {
+          "name": "has",
+          "label": "HAS",
+          "function": "has(expr, value)"
+        },
+        {
+          "name": "in",
+          "label": "IN",
+          "function": "expr in (values)"
+        },
+        {
+          "name": "not in",
+          "label": "NOT IN",
+          "function": "expr not in (values)"
+        },
+        {
+          "name": "like",
+          "label": "LIKE",
+          "function": "expr like value"
+        },
+        {
+          "name": "not like",
+          "label": "NOT LIKE",
+          "function": "expr not like value"
+        },
+        {
+          "name": "notEmpty",
+          "label": "NOT EMPTY",
+          "function": "notEmpty(expr)"
+        },
+        {
+          "name": "empty",
+          "label": "EMPTY",
+          "function": "empty(expr)"
+        }
+      ]
+    },
+    "schema_query": {
+      "references": {
+        "aggregation": [
+          {
+            "type": "int",
+            "functions": "COUNT,COUNT_DISTINCT,AVG,SUM,MAX,MIN"
+          },
+          {
+            "type": "long",
+            "functions": "COUNT,COUNT_DISTINCT,AVG,SUM,MAX,MIN"
+          },
+          {
+            "type": "float",
+            "functions": "COUNT,COUNT_DISTINCT,AVG,SUM,MAX,MIN"
+          },
+          {
+            "type": "double",
+            "functions": "COUNT,COUNT_DISTINCT,AVG,SUM,MAX,MIN"
+          },
+          {
+            "type": "string",
+            "functions": "COUNT,COUNT_DISTINCT"
+          },
+          {
+            "type": "date",
+            "functions": "COUNT,COUNT_DISTINCT,MAX,MIN"
+          },
+          {
+            "type": "timestamp",
+            "functions": "COUNT,COUNT_DISTINCT,MAX,MIN"
+          }
+        ],
+        "operator": [
+          {
+            "type": "int",
+            "functions": "=,!=,>,<,>=,<=,in,not in"
+          },
+          {
+            "type": "long",
+            "functions": "=,!=,>,<,>=,<=,in,not in"
+          },
+          {
+            "type": "float",
+            "functions": "=,!=,>,<,>=,<="
+          },
+          {
+            "type": "double",
+            "functions": "=,!=,>,<,>=,<="
+          },
+          {
+            "type": "string",
+            "functions": "=,!=,in,not in,like,not like,notEmpty,empty"
+          },
+          {
+            "type": "date",
+            "functions": "=,!=,>,<,>=,<="
+          },
+          {
+            "type": "timestamp",
+            "functions": "=,!=,>,<,>=,<="
+          },
+          {
+            "type": "array",
+            "functions": "has"
+          }
+        ]
+      }
+    },
+    "default_columns": [
+      "log_id",
+      "attack_type",
+      "source_ip_list",
+      "destination_ip",
+      "severity",
+      "start_time",
+      "end_time",
+      "packet_rate",
+      "bit_rate",
+      "session_rate"
+    ]
+  },
+  "fields": [
+    {
+      "name": "start_time",
+      "label": "Start Time",
+      "doc": {
+        "allow_query": "true",
+        "constraints": {
+          "type": "timestamp"
+        }
+      },
+      "type": "long"
+    },
+    {
+      "name": "end_time",
+      "label": "End Time",
+      "doc": {
+        "constraints": {
+          "type": "timestamp"
+        }
+      },
+      "type": "long"
+    },
+    {
+      "name": "log_id",
+      "label": "Log ID",
+      "doc": {
+        "allow_query": "true",
+        "format": {
+          "functions": "snowflake_id"
+        }
+      },
+      "type": "long"
+    },
+    {
+      "name": "attack_type",
+      "label": "Attack Type",
+      "doc": {
+        "allow_query": "true",
+        "constraints": {
+          "operator_functions": "=,!="
+        },
+        "data": [
+          {
+            "code": "TCP SYN Flood",
+            "value": "TCP SYN Flood"
+          },
+          {
+            "code": "UDP Flood",
+            "value": "UDP Flood"
+          },
+          {
+            "code": "ICMP Flood",
+            "value": "ICMP Flood"
+          },
+          {
+            "code": "DNS Amplification",
+            "value": "DNS Amplification"
+          }
+        ]
+      },
+      "type": "string"
+    },
+    {
+      "name": "severity",
+      "label": "Severity",
+      "doc": {
+        "allow_query": "true",
+        "constraints": {
+          "operator_functions": "=,!="
+        },
+        "data": [
+          {
+            "code": "Critical",
+            "value": "Critical"
+          },
+          {
+            "code": "Severe",
+            "value": "Severe"
+          },
+          {
+            "code": "Major",
+            "value": "Major"
+          },
+          {
+            "code": "Warning",
+            "value": "Warning"
+          },
+          {
+            "code": "Minor",
+            "value": "Minor"
+          }
+        ]
+      },
+      "type": "string"
+    },
+    {
+      "name": "conditions",
+      "label": "Conditions",
+      "type": "string"
+    },
+    {
+      "name": "destination_ip",
+      "label": "Destination IP",
+      "doc": {
+        "allow_query": "true"
+      },
+      "type": "string"
+    },
+    {
+      "name": "destination_country",
+      "label": "Destination Country",
+      "type": "string"
+    },
+    {
+      "name": "source_ip_list",
+      "label": "Source IPs",
+      "type": "string"
+    },
+    {
+      "name": "source_country_list",
+      "label": "Source Countries",
+      "type": "string"
+    },
+    {
+      "name": "session_rate",
+      "label": "Sessions/s",
+      "doc": {
+        "constraints": {
+          "type": "sessions/sec"
+        }
+      },
+      "type": "long"
+    },
+    {
+      "name": "packet_rate",
+      "label": "Packets/s",
+      "doc": {
+        "constraints": {
+          "type": "packets/sec"
+        }
+      },
+      "type": "long"
+    },
+    {
+      "name": "bit_rate",
+      "label": "Bits/s",
+      "doc": {
+        "constraints": {
+          "type": "bits/sec"
+        }
+      },
+      "type": "long"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/druid-filter.json b/parcels/roles/services/galaxy-qgw-service/files/config/druid-filter.json
index 5c437b9..d124633 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/druid-filter.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/druid-filter.json
@@ -1,6 +1,6 @@
 {
   "version": "1.0",
-  "name": "connection_record_log",
+  "name": "druid-Raw",
   "namespace": "druid",
   "filters": [
     {
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/engine-filter.json b/parcels/roles/services/galaxy-qgw-service/files/config/engine-filter.json
index 0fda6d4..21fc9d5 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/engine-filter.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/engine-filter.json
@@ -1,6 +1,6 @@
 {
   "version": "1.0",
-  "name": "connection_record_log",
+  "name": "Engine-Raw",
   "namespace": "Engine",
   "filters": [
     {
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/gtpc_record_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/gtpc_record_log.json
index d64604d..29a5d10 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/gtpc_record_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/gtpc_record_log.json
@@ -130,7 +130,8 @@
         "gtp_apn",
         "gtp_imei",
         "gtp_imsi",
-        "gtp_phone_number"
+        "gtp_phone_number",
+        "gtp_msg_type"
       ],
       "metrics": [
         "common_server_ip",
@@ -347,7 +348,9 @@
           "common_s2c_byte_retrans",
           "common_first_ttl",
           "common_tcp_client_isn",
-          "common_tcp_server_isn"
+          "common_tcp_server_isn",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "other": [
           "common_address_type",
@@ -443,6 +446,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "gtp_version",
           "gtp_apn",
           "gtp_imei",
@@ -1403,6 +1408,22 @@
       },
       "type": "long"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
     {
       "name": "gtp_version",
       "label": "Version",
@@ -1470,7 +1491,8 @@
             "code": "delete",
             "value": "delete"
           }
-        ]
+        ],
+        "allow_query": "true"
       },
       "type": "string"
     },
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_history.json b/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_history.json
index a1a8403..0f18e0b 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_history.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_history.json
@@ -149,4 +149,4 @@
     }
   },
   "fields": []
-}
+}
\ No newline at end of file
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_live.json b/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_live.json
index d490f3e..c041855 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_live.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/liveChart_live.json
@@ -149,4 +149,4 @@
     }
   },
   "fields": []
-}
+}
\ No newline at end of file
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/live_session_record_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/live_session_record_log.json
index 00bf742..062bcf1 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/live_session_record_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/live_session_record_log.json
@@ -354,7 +354,9 @@
           "common_s2c_byte_retrans",
           "common_first_ttl",
           "common_tcp_client_isn",
-          "common_tcp_server_isn"
+          "common_tcp_server_isn",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "other": [
           "common_address_type",
@@ -449,7 +451,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -539,6 +543,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "http_url",
           "http_host",
           "http_domain",
@@ -654,6 +660,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "mail_protocol_type",
           "mail_account",
           "mail_from_cmd",
@@ -761,6 +769,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "dns_message_id",
           "dns_qr",
           "dns_opcode",
@@ -868,6 +878,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "ssl_sni",
           "ssl_san",
           "ssl_cn",
@@ -974,6 +986,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "quic_version",
           "quic_sni",
           "quic_user_agent"
@@ -1067,6 +1081,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "ftp_account",
           "ftp_url",
           "ftp_content",
@@ -1161,6 +1177,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "bgp_type",
           "bgp_as_num",
           "bgp_route"
@@ -1255,6 +1273,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "sip_call_id",
           "sip_originator_description",
           "sip_responder_description",
@@ -1362,6 +1382,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "rtp_payload_type_c2s",
           "rtp_payload_type_s2c",
           "rtp_pcap_path",
@@ -1457,6 +1479,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "app_extra_info"
         ],
         "default_columns": [
@@ -2433,6 +2457,22 @@
       },
       "type": "long"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
     {
       "name": "http_url",
       "label": "HTTP.URL",
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/meta_data.json b/parcels/roles/services/galaxy-qgw-service/files/config/meta_data.json
index da93253..9fc2504 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/meta_data.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/meta_data.json
@@ -1,73 +1,72 @@
-[
+{
+  "metadata": [
     {
-        "namespace":"tsg_galaxy_v3",
-        "group":"CLICKHOUSE_GROUP",
-        "tables":[
-            "connection_record_log",
-            "proxy_ip_info",
-            "radius_record_log",
-            "security_ip_info",
-            "connection_record_log_common_subscriber_id",
-            "proxy_event_log",
-            "security_event_log",
-            "connection_record_log_http_domain",
-            "sys_packet_capture_log",
-            "radius_onff_log",
-            "active_defence_event_log",
-            "connection_record_log_common_server_ip",
-            "security_website_domain_info",
-            "connection_record_log_common_client_ip",
-            "voip_record_log",
-            "transaction_record_log",
-            "gtpc_record_log",
-            "live_session_record_log"
-        ]
+      "namespace": "tsg_galaxy_v3",
+      "group": "CLICKHOUSE_GROUP",
+      "tables": [
+        "connection_record_log",
+        "radius_record_log",
+        "proxy_event_log",
+        "security_event_log",
+        "connection_record_log_http_domain",
+        "sys_packet_capture_log",
+        "radius_onff_log",
+        "active_defence_event_log",
+        "connection_record_log_common_server_ip",
+        "connection_record_log_common_client_ip",
+        "voip_record_log",
+        "transaction_record_log",
+        "gtpc_record_log",
+        "live_session_record_log",
+        "dos_event_log"
+      ]
     },
     {
-        "namespace":"system",
-        "group":"CLICKHOUSE_GROUP",
-        "tables":[
-            "query_log_cluster",
-            "tables_cluster",
-            "columns_cluster",
-            "disks_cluster",
-            "parts_cluster",
-            "processes",
-            "query_log"
-        ]
+      "namespace": "system",
+      "group": "CLICKHOUSE_GROUP",
+      "tables": [
+        "query_log_cluster",
+        "tables_cluster",
+        "columns_cluster",
+        "disks_cluster",
+        "parts_cluster",
+        "processes",
+        "query_log"
+      ]
     },
     {
-        "namespace":"druid",
-        "group":"DRUID_GROUP",
-        "tables":[
-            "top_domain_recommend_daily_log",
-            "source_country_ip_num_log",
-            "top_internal_host_log",
-            "top_website_domain_log",
-            "sd_multi_access_cnt_feature",
-            "proxy_event_hits_log",
-            "sys_storage_log",
-            "domain_country_num_log",
-            "security_event_hits_log",
-            "traffic_protocol_stat_log",
-            "top_website_urls_daily_log",
-            "top_server_ip_log",
-            "traffic_summary_log",
-            "traffic_metrics_log",
-            "top_user_log",
-            "destination_country_log",
-            "top_urls_log",
-            "top_client_ip_log",
-            "top_external_host_log",
-            "traffic_app_stat_log"
-        ]
+      "namespace": "elasticsearch",
+      "group": "ES_GROUP",
+      "tables": []
     },
     {
-        "namespace":"etl",
-        "group":"ETL_GROUP",
-        "tables":[
-            "liveChart_history",
-            "liveChart_live"
-        ]
+      "namespace": "druid",
+      "group": "DRUID_GROUP",
+      "tables": [
+        "top_internal_host_log",
+        "top_website_domain_log",
+        "proxy_event_hits_log",
+        "sys_storage_log",
+        "security_event_hits_log",
+        "traffic_protocol_stat_log",
+        "top_server_ip_log",
+        "traffic_summary_log",
+        "traffic_metrics_log",
+        "top_user_log",
+        "top_urls_log",
+        "top_client_ip_log",
+        "top_external_host_log",
+        "traffic_app_stat_log",
+        "traffic_top_destination_ip_metrics_log"
+      ]
+    },
+    {
+      "namespace": "etl",
+      "group": "ETL_GROUP",
+      "tables": [
+        "liveChart_history",
+        "liveChart_live"
+      ]
     }
-]
\ No newline at end of file
+  ]
+}
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/proxy_event_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/proxy_event_log.json
index 0f0072b..cf8cd6e 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/proxy_event_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/proxy_event_log.json
@@ -329,7 +329,9 @@
           "common_s2c_byte_retrans",
           "common_first_ttl",
           "common_tcp_client_isn",
-          "common_tcp_server_isn"
+          "common_tcp_server_isn",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "other": [
           "common_address_type",
@@ -425,6 +427,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "http_url",
           "http_host",
           "http_domain",
@@ -541,6 +545,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "doh_url",
           "doh_host",
           "doh_request_line",
@@ -1582,6 +1588,22 @@
       },
       "type": "long"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
     {
       "name": "http_url",
       "label": "HTTP.URL",
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/radius_record_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/radius_record_log.json
index 122f454..de2d4ef 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/radius_record_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/radius_record_log.json
@@ -268,7 +268,9 @@
           "common_s2c_byte_retrans",
           "common_first_ttl",
           "common_tcp_client_isn",
-          "common_tcp_server_isn"
+          "common_tcp_server_isn",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "other": [
           "common_address_type",
@@ -364,6 +366,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "radius_packet_type",
           "radius_nas_ip",
           "radius_framed_ip",
@@ -1394,6 +1398,22 @@
       },
       "type": "long"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
     {
       "name": "radius_packet_type",
       "label": "Packet Type",
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/security_event_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/security_event_log.json
index c5d34cd..edc1cb1 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/security_event_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/security_event_log.json
@@ -158,6 +158,8 @@
         "common_s2c_pkt_num",
         "common_c2s_byte_num",
         "common_s2c_byte_num",
+        "common_mirrored_pkts",
+        "common_mirrored_bytes",
         "common_con_duration_ms",
         "common_establish_latency_ms",
         "common_imei",
@@ -193,6 +195,8 @@
         "common_s2c_pkt_num",
         "common_c2s_byte_num",
         "common_s2c_byte_num",
+        "common_mirrored_pkts",
+        "common_mirrored_bytes",
         "common_l4_protocol",
         "common_l7_protocol",
         "common_stream_dir",
@@ -374,7 +378,9 @@
           "common_s2c_byte_retrans",
           "common_first_ttl",
           "common_tcp_client_isn",
-          "common_tcp_server_isn"
+          "common_tcp_server_isn",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "other": [
           "common_address_type",
@@ -469,7 +475,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -560,6 +568,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "http_url",
           "http_host",
           "http_domain",
@@ -676,6 +686,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "mail_protocol_type",
           "mail_account",
           "mail_from_cmd",
@@ -784,6 +796,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "dns_message_id",
           "dns_qr",
           "dns_opcode",
@@ -892,6 +906,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "ssl_sni",
           "ssl_san",
           "ssl_cn",
@@ -999,6 +1015,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "quic_version",
           "quic_sni",
           "quic_user_agent"
@@ -1093,6 +1111,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "ftp_account",
           "ftp_url",
           "ftp_content",
@@ -1188,6 +1208,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "bgp_type",
           "bgp_as_num",
           "bgp_route"
@@ -1283,6 +1305,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "sip_call_id",
           "sip_originator_description",
           "sip_responder_description",
@@ -1390,6 +1414,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "rtp_payload_type_c2s",
           "rtp_payload_type_s2c",
           "rtp_pcap_path",
@@ -1484,6 +1510,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "app_extra_info"
         ],
         "default_columns": [
@@ -2503,6 +2531,22 @@
       },
       "type": "long"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "allow_query": "true"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "allow_query": "true"
+      }
+    },
     {
       "name": "http_url",
       "label": "HTTP.URL",
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/sys_packet_capture_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/sys_packet_capture_log.json
index 73e9454..744ce90 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/sys_packet_capture_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/sys_packet_capture_log.json
@@ -721,6 +721,22 @@
       },
       "label": "Processing Time"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
     {
       "name": "nic_name",
       "type": "string",
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/traffic_top_destination_ip_metrics_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/traffic_top_destination_ip_metrics_log.json
new file mode 100644
index 0000000..bb056eb
--- /dev/null
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/traffic_top_destination_ip_metrics_log.json
@@ -0,0 +1,42 @@
+{
+  "type": "record",
+  "name": "traffic_top_destination_ip_metrics_log",
+  "namespace": "druid",
+  "doc": {
+    "partition_key": "__time"
+  },
+  "fields": [
+    {
+      "name": "__time",
+      "type": "long"
+    },
+    {
+      "name": "common_sled_ip",
+      "type": "string"
+    },
+    {
+      "name": "common_data_center",
+      "type": "string"
+    },
+    {
+      "name": "destination_ip",
+      "type": "string"
+    },
+    {
+      "name": "attack_type",
+      "type": "string"
+    },
+    {
+      "name": "session_rate",
+      "type": "long"
+    },
+    {
+      "name": "packet_rate",
+      "type": "long"
+    },
+    {
+      "name": "bit_rate",
+      "type": "long"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/transaction_record_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/transaction_record_log.json
index 5657c8b..2827a74 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/transaction_record_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/transaction_record_log.json
@@ -348,7 +348,9 @@
           "common_s2c_byte_retrans",
           "common_first_ttl",
           "common_tcp_client_isn",
-          "common_tcp_server_isn"
+          "common_tcp_server_isn",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "other": [
           "common_address_type",
@@ -443,7 +445,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -533,6 +537,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "http_url",
           "http_host",
           "http_domain",
@@ -647,7 +653,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -735,6 +743,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "dns_message_id",
           "dns_qr",
           "dns_opcode",
@@ -841,7 +851,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -930,7 +942,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -1019,7 +1033,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -1108,7 +1124,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -1194,6 +1212,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "sip_call_id",
           "sip_originator_description",
           "sip_responder_description",
@@ -1300,7 +1320,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -1389,7 +1411,9 @@
           "common_tcp_client_isn",
           "common_tcp_server_isn",
           "common_first_ttl",
-          "common_processing_time"
+          "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "default_columns": [
           "common_recv_time",
@@ -2338,6 +2362,22 @@
       },
       "label": "Processing Time"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
     {
       "name": "http_url",
       "type": "string",
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/version.json b/parcels/roles/services/galaxy-qgw-service/files/config/version.json
index 4dd1f6a..7d68837 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/version.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/version.json
@@ -1,8 +1,8 @@
 {
     "product": "185 Environment",
-    "version": "21.07",
+    "version": "21.08",
     "registered": "Geedge",
-    "updated": "2021-08-01 00:00:00",
+    "updated": "2021-08-25 00:00:00",
     "components": {
         "oss": [
             {
@@ -24,8 +24,8 @@
                 "description": "用于文件系统和存储Radius数据"
             },
             {
-                "name": "flume",
-                "version": "1.9.0",
+                "name": "flink",
+                "version": "1.13.1",
                 "licenseType": "Apache License 2.0",
                 "description": "日志补全传输"
             },
@@ -50,7 +50,7 @@
         "apps": [
             {
                 "name": "galaxy-qgw-service",
-                "version": "345",
+                "version": "346",
                 "description": "数据平台对外统一查询网关"
             },
             {
@@ -60,36 +60,36 @@
             },
             {
                 "name": "galaxy-hos-service",
-                "version": "21.07.01",
+                "version": "21.08.25",
                 "description": "对象存储服务"
             },
             {
-                "name": "xxl-job-admin",
+                "name": "galaxy-job-admin",
                 "version": "v1.3.20210408",
                 "description": "分布式任务调度平台"
             },
             {
-                "name": "xxl-job",
-                "version": "v1.3.210413-rc1",
+                "name": "galaxy-job-executor",
+                "version": "v1.3.210716",
                 "description": "分布式任务调度平台-执行器"
             }
         ],
         "tasks": [
             {
-                "name": "flume",
-                "version": "flume-config-20.08",
-                "description": "原始日志补全、subscriber更新、Radius上下线功能"
+                "name": "flink",
+                "version": "flink-config-21.08",
+                "description": "原始日志补全、subscriber更新、Radius上下线功能、ddos"
             },
             {
                 "name": "druid",
-                "version": "druid-config-20.08",
+                "version": "druid-config-21.08",
                 "description": "所有分析日志任务"
             },
             {
                 "name": "gohangout",
-                "version": "gohangout-config-20.08",
+                "version": "gohangout-config-21.08",
                 "description": "原始日志入库、上下线日志入库"
             }
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/parcels/roles/services/galaxy-qgw-service/files/config/voip_record_log.json b/parcels/roles/services/galaxy-qgw-service/files/config/voip_record_log.json
index 3691e86..3ead2b9 100644
--- a/parcels/roles/services/galaxy-qgw-service/files/config/voip_record_log.json
+++ b/parcels/roles/services/galaxy-qgw-service/files/config/voip_record_log.json
@@ -356,7 +356,9 @@
           "common_s2c_byte_retrans",
           "common_first_ttl",
           "common_tcp_client_isn",
-          "common_tcp_server_isn"
+          "common_tcp_server_isn",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes"
         ],
         "other": [
           "common_address_type",
@@ -452,6 +454,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "sip_call_id",
           "sip_originator_description",
           "sip_responder_description",
@@ -559,6 +563,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "rtp_payload_type_c2s",
           "rtp_payload_type_s2c",
           "rtp_pcap_path",
@@ -654,6 +660,8 @@
           "common_tcp_server_isn",
           "common_first_ttl",
           "common_processing_time",
+          "common_mirrored_pkts",
+          "common_mirrored_bytes",
           "sip_call_id",
           "sip_originator_description",
           "sip_responder_description",
@@ -1639,6 +1647,22 @@
       },
       "type": "long"
     },
+    {
+      "name": "common_mirrored_pkts",
+      "label": "Mirrored Packets",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
+    {
+      "name": "common_mirrored_bytes",
+      "label": "Mirrored Bytes",
+      "type": "long",
+      "doc": {
+        "visibility": "hidden"
+      }
+    },
     {
       "name": "sip_call_id",
       "label": "SIP.Call-ID",
diff --git a/parcels/roles/services/galaxy-qgw-service/templates/galaxy-qgw-service.yml.j2 b/parcels/roles/services/galaxy-qgw-service/templates/galaxy-qgw-service.yml.j2
index 2a36583..ca2f875 100644
--- a/parcels/roles/services/galaxy-qgw-service/templates/galaxy-qgw-service.yml.j2
+++ b/parcels/roles/services/galaxy-qgw-service/templates/galaxy-qgw-service.yml.j2
@@ -30,6 +30,17 @@ spring:
     url: jdbc:mysql://{{ bifang_mariadb_host }}:3306/tsg-bifang?useUnicode=true&characterEncoding=UTF-8&autoReconnect=true&serverTimezone=GMT
     username: root
     pin: {{ bifang_mariadb_pin }}
+## Hbase configuration
+hbase:
+  zookeeperQuorum: {{ zookeeper_servers }}
+  zookeeperZnodeParent: /hbase
+  dbname: tsg
+  tableName: report_result
+  columnFamily: response
+  columnName: result
+  clientIpcPoolSize: 70
+  rpcTimeout: 60000
+
 ##############动态参数配置(修改后不需要重启项目)##############
 ## 项目参数
 project:
@@ -49,13 +60,14 @@ project:
 clickhouse:
   url: http://{{ gateway_keepalive_host }}:8124
   dbname: tsg_galaxy_v3
+  enableApproximateOptimizer: true
   realTimeAccount:
     username: tsg_query
-    pin: ceiec2018
+    pin: galaxy2018
     socketTimeOut: 60000
   longTermAccount:
     username: tsg_report
-    pin: ceiec2019
+    pin: galaxy2019
     socketTimeOut: 21700000
 ## Druid configuration
 druid:
@@ -67,16 +79,7 @@ elasticsearch:
   url: 127.0.0.1:9200/_sql
   dbname: elasticsearch
   socketTimeOut: 60000
-## Hbase configuration
-hbase:
-  zookeeperQuorum: {{ zookeeper_servers }}
-  zookeeperZnodeParent: /hbase
-  dbname: tsg
-  tableName: report_result
-  columnFamily: response
-  columnName: result
-  clientIpcPoolSize: 60
-  rpcTimeout: 60000
+
 ## xxl-job-admin configuration
 xxl-job-admin:
   url: http://{{ gateway_keepalive_host }}:8181/xxl-job-admin
@@ -84,14 +87,14 @@ xxl-job-admin:
   pin: galaxy_2019
 ## Engine configuration
 engine:
-  maxCacheNum: 1048576
+  maxCacheNum: 1048575
   defaultResultNum: 100000
 ## ArangoDB configuration
 arango:
   server: http://{{groups.arangodb[0]}}:8529
   database: tsg_galaxy_v3
   username: query
-  pin: ceiec2018
+  pin: galaxy2018
   jwturl: ${arango.server}/_db/${arango.database}/_open/auth
   queryurl: ${arango.server}/_db/${arango.database}/_api/cursor
   maxrows: 10000
@@ -108,4 +111,4 @@ http:
     request:
       timeout: 10000
     response:
-      timeout: 10000
+      timeout: 60000
diff --git a/parcels/roles/services/galaxy-qgw-service/vars/main.yml b/parcels/roles/services/galaxy-qgw-service/vars/main.yml
index ae83df9..cf5d058 100644
--- a/parcels/roles/services/galaxy-qgw-service/vars/main.yml
+++ b/parcels/roles/services/galaxy-qgw-service/vars/main.yml
@@ -1,14 +1,14 @@
 #注意这里面定义的key中不能包含减号-,否则程序无法识别定义的key
 
 #离线模式下使用:bifang-api的docker镜像文件名称,在../file中的文件名称
-qgw_image_tar_name: galaxy-qgw-service-345.tar
+qgw_image_tar_name: galaxy-qgw-service-346.tar
 
 ##########################公共属性#############################
 #{{ image_tar_name }}中的镜像名称,或者{{ docker_registry_image_and_tag }}中的镜像名称,不含版本号
 qgw_image_name: galaxy-qgw-service
 
 #{{ image_tar_name }}的镜像版本号,或者{{ docker_registry_image_and_tag }}中的镜像版本号
-qgw_image_tag_name: 345
+qgw_image_tag_name: 346
 
 #{{ image_tar_name }}的镜像,或者{{ docker_registry_image_and_tag }}中的镜像启动后的容器名称
 qgw_image_container_name: galaxy-qgw-service
diff --git a/parcels/test.yml b/parcels/test.yml
index d268252..7d659ee 100644
--- a/parcels/test.yml
+++ b/parcels/test.yml
@@ -3,9 +3,9 @@
   remote_user: root
   roles:
    - components/test
-#  vars_files:
-#   - ../configurations/config.yml
-#   - ../configurations/components.yml
-#   - ../configurations/services.yml
-#   - roles/components/zookeeper/vars/main.yml
+  vars_files:
+   - ../configurations/config.yml
+   - ../configurations/components.yml
+   - ../configurations/services.yml
+   - roles/components/zookeeper/vars/main.yml
 
diff --git a/parcels/test1.yml b/parcels/test1.yml
index b6f6a77..06b9de5 100644
--- a/parcels/test1.yml
+++ b/parcels/test1.yml
@@ -4,4 +4,30 @@
   tasks:
     - name: message
       debug:
-        msg: "{{ package_path }} {{ playbook_dir | dirname }} {{ qgw_image_tar_name }}"
+        msg: "{{ package_path }} {{ playbook_dir | dirname }}"
+
+    - name: change hostname
+      debug:
+        msg:
+          win_hostname:
+            name: "{{ item }}"
+      loop: "{{ groups.flink|list }}"
+
+    - name: mee
+      debug:
+        msg: "{{groups['flink'].index}}"
+
+    - name: Print index of each host
+      shell: echo "yes"
+      delegate_to: "{{ item }}"
+      loop: "{{ groups['flink'] }}"
+      loop_control:
+        index_var: index_no
+      #debug:
+      #  msg: "{{groups['flink'].index}}"
+      when: index_no >= 0
+
+  vars_files:
+    - ../configurations/config.yml
+    - ../configurations/components.yml
+    - roles/components/arangodb/vars/main.yml