* |
SELECT
__time__ AS "日志时间戳",
regexp_extract(content, 'date=(\d{4}-\d{2}-\d{2})', 1) AS "日志日期",
regexp_extract(content, 'time=(\d{2}:\d{2}:\d{2})', 1) AS "日志时间",
regexp_extract(content, 'devname="([^"]+)"', 1) AS "设备名称",
regexp_extract(content, 'devid="([^"]+)"', 1) AS "设备唯一 ID",
regexp_extract(content, 'logid="([^"]+)"', 1) AS "日志 ID",
regexp_extract(content, 'type="([^"]+)"', 1) AS "日志类型",
regexp_extract(content, 'subtype="([^"]+)"', 1) AS "日志子类型",
regexp_extract(content, 'level="([^"]+)"', 1) AS "日志级别",
regexp_extract(content, 'vd="([^"]+)"', 1) AS "虚拟域",
regexp_extract(content, 'eventtime=(\d+)', 1) AS "事件时间戳",
regexp_extract(content, 'user="([^"]+)"', 1) AS "操作用户",
regexp_extract(content, 'srcip=(\d+.\d+.\d+.\d+)', 1) AS "源 IP 地址",
regexp_extract(content, 'srcport=(\d+)', 1) AS "源端口",
regexp_extract(content, 'srcintf=([^ ]+)', 1) AS "源接口",
regexp_extract(content, 'srcintfrole="([^"]+)"', 1) AS "源接口角色",
regexp_extract(content, 'dstip=(\d+.\d+.\d+.\d+)', 1) AS "目的 IP 地址",
regexp_extract(content, 'dstport=(\d+)', 1) AS "目的端口",
regexp_extract(content, 'dstintf="([^"]+)"', 1) AS "目的接口",
regexp_extract(content, 'dstintfrole="([^"]+)"', 1) AS "目的接口角色",
regexp_extract(content, 'sessionid=(\d+)', 1) AS "会话 ID",
regexp_extract(content, 'proto=(\d+)', 1) AS "协议类型",
regexp_extract(content, 'action="([^"]+)"', 1) AS "防火墙动作",
regexp_extract(content, 'policyid=(\d+)', 1) AS "策略 ID",
regexp_extract(content, 'policytype="([^"]+)"', 1) AS "策略类型",
regexp_extract(content, 'service="([^"]+)"', 1) AS "服务类型",
regexp_extract(content, 'dstcountry="([^"]+)"', 1) AS "目的地址国家",
regexp_extract(content, 'srccountry="([^"]+)"', 1) AS "源地址国家",
regexp_extract(content, 'trandisp="([^"]+)"', 1) AS "地址转换状态",
regexp_extract(content, 'app="([^"]+)"', 1) AS "应用识别",
regexp_extract(content, 'duration=(\d+)', 1) AS "会话时长",
regexp_extract(content, 'sentbyte=(\d+)', 1) AS "发送字节数",
regexp_extract(content, 'rcvdbyte=(\d+)', 1) AS "接收字节数",
regexp_extract(content, 'sentpkt=(\d+)', 1) AS "发送数据包数",
regexp_extract(content, 'appcat="([^"]+)"', 1) AS "应用分类",
regexp_extract(content, 'status="([^"]+)"', 1) AS "操作状态",
regexp_extract(content, 'method="([^"]+)"', 1) AS "访问方式",
regexp_extract(content, 'msg="([^"]+)"', 1) AS "日志描述信息"
FROM log
LIMIT 200