编写第一个 MQL 查询来实现以下功能:
注意:两个日志都有一个公共字段 flowExecutionId,其值对于每个事务都保持相同。
fetch logging.googleapis.com/user/count_verify_country
| filter has(jsonPayload.requestBody.actors.client.verify.country)
| group_by [jsonPayload.requestBody.actors.client.daVinciFlow.flowExecutionId], [country: any(jsonPayload.requestBody.actors.client.verify.country)]
| join (
fetch logging.googleapis.com/user/verify_completed
| filter jsonPayload.requestBody.success.message == "Verify Completed"
| group_by [jsonPayload.requestBody.actors.client.daVinciFlow.flowExecutionId], [success_count: count_true()]
) on jsonPayload.requestBody.actors.client.daVinciFlow.flowExecutionId
| outer_join
| group_by [country], [total_success: sum(success_count)]```
Getting error: Line 5: Expected: ')'. Instead found: 'logging'.
您提到您要将所有出现的 MESSAGE 计为 SUCCESS。但是当您过滤 verify_completed 日志时,您会给出“Verify Completed”。因此,请尝试在线路过滤器 SUCCESS
处使用
Verify Completed
代替
jsonPayload.requestBody.success.message == "SUCCESS"
,并且不需要 external_join。
fetch logging.googleapis.com/user/count_verify_country
| filter has(jsonPayload.requestBody.actors.client.verify.country)
| group_by [jsonPayload.requestBody.actors.client.daVinciFlow.flowExecutionId], [country: any(jsonPayload.requestBody.actors.client.verify.country)]
| join (
fetch logging.googleapis.com/user/verify_completed
| filter jsonPayload.requestBody.success.message == "SUCCESS"
| group_by [jsonPayload.requestBody.actors.client.daVinciFlow.flowExecutionId], [success_count: count()]
) on jsonPayload.requestBody.actors.client.daVinciFlow.flowExecutionId
| group_by [country], [total_success: sum(success_count)]
请参阅此官方 MQL 示例文档了解更多信息。