StarRocks慢查询巡检规则

1. 最近两周慢查询数环比增长速率

复制代码

-- 步骤1：定义时间范围（最近两周），并按周聚合慢查询数
WITH time_range AS (
    -- 计算最近两周的时间边界：取当前日期往前推14天，且截断到周起始（周一）
    SELECT
        -- 上周起始（周一）
        DATE_TRUNC('week', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY)) AS last_week_start,
        -- 本周起始（周一）
        DATE_TRUNC('week', CURRENT_DATE()) AS current_week_start,
        -- 时间范围下限（最近两周的最早时间）
        DATE_SUB(DATE_TRUNC('week', CURRENT_DATE()), INTERVAL 14 DAY) AS start_time
),
weekly_slow_query AS (
    SELECT
        -- 按周聚合（区分上周/本周）
        DATE_TRUNC('week', t.`timestamp`) AS week_start,
        -- 标记周类型（便于识别）
        CASE 
            WHEN DATE_TRUNC('week', t.`timestamp`) = (SELECT last_week_start FROM time_range) THEN 'last_week'
            WHEN DATE_TRUNC('week', t.`timestamp`) = (SELECT current_week_start FROM time_range) THEN 'current_week'
        END AS week_type,
        -- 统计该周慢查询数量
        COUNT(*) AS slow_query_count
    FROM starrocks_audit_db__.starrocks_audit_tbl__ t
    CROSS JOIN time_range tr
    -- 筛选条件：慢查询 + 最近两周数据 + 有效时间
    WHERE t.queryType = 'slow_query'
      AND t.`timestamp` >= tr.start_time
      AND t.`timestamp` < DATE_ADD(tr.current_week_start, INTERVAL 7 DAY)
    GROUP BY week_start
),
-- 步骤2：行转列，将上周/本周数据合并为一行，便于计算增长率
pivot_week AS (
    SELECT
        MAX(CASE WHEN week_type = 'last_week' THEN slow_query_count END) AS last_week_count,
        MAX(CASE WHEN week_type = 'current_week' THEN slow_query_count END) AS current_week_count
    FROM weekly_slow_query
)
-- 步骤3：计算增长速率（核心）
SELECT
    last_week_count AS 上周慢查询数,
    current_week_count AS 本周慢查询数,
    -- 增长数
    current_week_count - last_week_count AS 增长数,
    -- 增长速率（百分比，保留2位小数，处理除0错误）
    ROUND(
        (current_week_count - last_week_count) / NULLIF(last_week_count, 0) * 100,
        2
    ) AS 增长速率_百分比
FROM pivot_week;

2. 最近两周平均查询时间增长速率

复制代码

-- 步骤1：定义最近两周的时间边界（聚焦上周+本周）
WITH time_range AS (
    SELECT
        -- 上周起始（周一）
        DATE_TRUNC('week', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY)) AS last_week_start,
        -- 本周起始（周一）
        DATE_TRUNC('week', CURRENT_DATE()) AS current_week_start,
        -- 最近两周的时间下限（避免包含更早数据）
        DATE_SUB(DATE_TRUNC('week', CURRENT_DATE()), INTERVAL 14 DAY) AS start_time
),
-- 步骤2：筛选有效查询记录，按周聚合计算平均查询时间
weekly_avg_query_time AS (
    SELECT
        -- 按周截断时间，区分上周/本周
        DATE_TRUNC('week', t.`timestamp`) AS week_start,
        -- 标记周类型（便于后续匹配）
        CASE 
            WHEN DATE_TRUNC('week', t.`timestamp`) = (SELECT last_week_start FROM time_range) THEN 'last_week'
            WHEN DATE_TRUNC('week', t.`timestamp`) = (SELECT current_week_start FROM time_range) THEN 'current_week'
        END AS week_type,
        -- 计算该周平均查询时间（毫秒，保留2位小数）
        ROUND(AVG(t.queryTime), 2) AS avg_query_time_ms
    FROM starrocks_audit_db__.starrocks_audit_tbl__ t
    CROSS JOIN time_range tr
    -- 筛选条件：
    -- 1. 仅统计查询类语句（排除connection等非查询）
    -- 2. 排除queryTime为空/0的无效记录
    -- 3. 仅保留最近两周数据
    WHERE t.queryType IN ('query', 'slow_query')
      AND t.queryTime > 0
      AND t.`timestamp` >= tr.start_time
      AND t.`timestamp` < DATE_ADD(tr.current_week_start, INTERVAL 7 DAY)
    GROUP BY week_start
),
-- 步骤3：行转列，将两周数据合并为一行，便于计算增长率
pivot_week AS (
    SELECT
        MAX(CASE WHEN week_type = 'last_week' THEN avg_query_time_ms END) AS last_week_avg_time,
        MAX(CASE WHEN week_type = 'current_week' THEN avg_query_time_ms END) AS current_week_avg_time
    FROM weekly_avg_query_time
)
-- 步骤4：计算平均查询时间的增长速率（核心）
SELECT
    last_week_avg_time AS 上周平均查询时间_毫秒,
    current_week_avg_time AS 本周平均查询时间_毫秒,
    -- 增长数（毫秒）
    ROUND(current_week_avg_time - last_week_avg_time, 2) AS 平均查询时间增长数_毫秒,
    -- 增长速率（百分比，保留2位小数，处理除0错误）
    ROUND(
        (current_week_avg_time - last_week_avg_time) / NULLIF(last_week_avg_time, 0) * 100,
        2
    ) AS 平均查询时间增长速率_百分比
FROM pivot_week;

3. 最近两周Pt90查询时间增长速率

复制代码

-- 最终版：本周vs上周PT90环比增长统计
WITH 
-- 步骤1：定义时间范围（上周+本周），筛选有效查询数据
audit_filter AS (
    SELECT 
        queryTime, -- 查询时长（毫秒）
        timestamp,
        -- 标记数据所属周：上周=0，本周=1
        CASE 
            -- 本周：本周一 00:00 至今
            WHEN timestamp >= date_trunc('week', CURRENT_DATE()) 
                 AND timestamp <= CURRENT_TIMESTAMP() THEN 1
            -- 上周：上周周一 00:00 至本周一 00:00
            WHEN timestamp >= date_trunc('week', date_add(CURRENT_DATE(), INTERVAL -1 WEEK))
                 AND timestamp < date_trunc('week', CURRENT_DATE()) THEN 0
            ELSE -1 -- 非目标周数据（过滤）
        END AS week_flag
    FROM starrocks_audit_db__.starrocks_audit_tbl__
    WHERE 
        queryType IN ('query', 'slow_query') -- 仅查询类日志
        AND state = 'OK'                     -- 仅成功执行的查询
        AND queryTime > 0                    -- 排除异常零耗时
        -- 仅保留上周+本周数据
        AND timestamp >= date_trunc('week', date_add(CURRENT_DATE(), INTERVAL -1 WEEK))
),
-- 步骤2：按周计算PT90
week_pt90 AS (
    SELECT 
        week_flag,
        -- 90百分位查询时长（毫秒），保留2位小数
        ROUND(percentile_approx(queryTime, 0.9), 2) AS pt90_ms
    FROM audit_filter
    WHERE week_flag IN (0, 1) -- 仅保留上周+本周
    GROUP BY week_flag
),
-- 步骤3：行转列，拆分上周/本周PT90
pivot_pt90 AS (
    SELECT
        -- 上周PT90（week_flag=0）
        MAX(CASE WHEN week_flag = 0 THEN pt90_ms ELSE 0 END) AS last_week_pt90,
        -- 本周PT90（week_flag=1）
        MAX(CASE WHEN week_flag = 1 THEN pt90_ms ELSE 0 END) AS curr_week_pt90
    FROM week_pt90
)
-- 步骤4：计算环比增长（核心）
SELECT
    last_week_pt90 AS 上周PT90查询时长_毫秒,
    curr_week_pt90 AS 本周PT90查询时长_毫秒,
    -- 环比增长数 = 本周 - 上周
    ROUND(curr_week_pt90 - last_week_pt90, 2) AS 环比增长数_毫秒,
    -- 环比增长率 = (本周-上周)/上周 * 100%（处理上周为0的情况）
    CASE 
        WHEN last_week_pt90 = 0 THEN 
            IF(curr_week_pt90 > 0, 100.00, 0.00) -- 上周0，本周>0则增长率100%
        ELSE 
            ROUND((curr_week_pt90 - last_week_pt90) / last_week_pt90 * 100, 2)
    END AS 环比增长率_百分比
FROM pivot_pt90;

4. 最近两周扫描数据量增长速率

复制代码

WITH week_scan_stats AS (
    -- 第一步：按周聚合扫描字节数（兼容低版本DATE_TRUNC，周起始为周日，手动调整为周一）
    SELECT
        -- 计算周起始（周一）：先取周日为周起始，再+1天转为周一
        DATE_ADD(DATE_TRUNC('week', timestamp), INTERVAL 1 DAY) AS week_start,
        -- 汇总每周扫描字节数
        SUM(scanBytes) AS total_scan_bytes,
        -- 标记周类型（本周/上周）
        CASE 
            WHEN DATE_ADD(DATE_TRUNC('week', CURRENT_DATE()), INTERVAL 1 DAY) = DATE_ADD(DATE_TRUNC('week', timestamp), INTERVAL 1 DAY) 
                THEN 'current_week'
            WHEN DATE_ADD(DATE_TRUNC('week', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY)), INTERVAL 1 DAY) = DATE_ADD(DATE_TRUNC('week', timestamp), INTERVAL 1 DAY) 
                THEN 'last_week'
            ELSE 'other'
        END AS week_type
    FROM starrocks_audit_db__.starrocks_audit_tbl__
    -- 筛选最近两周数据（时间范围：当前时间往前推14天）
    WHERE timestamp >= DATE_SUB(CURRENT_DATE(), INTERVAL 14 DAY)
      AND timestamp < DATE_ADD(DATE_TRUNC('day', CURRENT_DATE()), INTERVAL 1 DAY)
    GROUP BY week_start
),
-- 第二步：行转列，提取上周/本周数据
pivot_week_data AS (
    SELECT
        COALESCE(SUM(CASE WHEN week_type = 'last_week' THEN total_scan_bytes ELSE 0 END), 0) AS last_week_scan_bytes,
        COALESCE(SUM(CASE WHEN week_type = 'current_week' THEN total_scan_bytes ELSE 0 END), 0) AS current_week_scan_bytes
    FROM week_scan_stats
)
-- 第三步：计算增长数和增长率（保留原逻辑，仅兼容时间计算）
SELECT
    -- 上周扫描数据量（GB，保留2位小数）
    ROUND(last_week_scan_bytes / 1024 / 1024 / 1024, 2) AS last_week_scan_gb,
    -- 本周扫描数据量
    ROUND(current_week_scan_bytes / 1024 / 1024 / 1024, 2) AS current_week_scan_gb,
    -- 增长数（GB）
    ROUND((current_week_scan_bytes - last_week_scan_bytes) / 1024 / 1024 / 1024, 2) AS scan_growth_gb,
    -- 增长率（百分比，处理除0错误）
    CASE 
        WHEN last_week_scan_bytes = 0 THEN 
            IF(current_week_scan_bytes > 0, 100.00, 0.00)
        ELSE 
            ROUND((current_week_scan_bytes - last_week_scan_bytes) / last_week_scan_bytes * 100, 2)
    END AS scan_growth_rate_percent
FROM pivot_week_data;