Help Center/ SecMaster/ User Guide/ Log Audit/ Query and Analysis Syntax - V2/ SecMaster SQL Syntax Reference/ Supported Data Types
Updated on 2026-09-14 GMT+08:00
View PDF
Share

Supported Data Types

SecMaster supports the following SQL syntax types:

STRING, BOOLEAN, BYTES, DECIMAL, TINYINT, SMALLINT, INTEGER, BIGINT, FLOAT, DOUBLE, DATE, TIME, TIMESTAMP, TIMESTAMP WITH LOCAL TIME ZONE, INTERVAL, ARRAY, MULTISET, MAP, ROW

  • Precautions
    1. SecMaster SQL statements are compatible with Flink 1.7.2 SQL syntax.
    1. Flink SQL uses a lexical policy for identifier (table, attribute, function names) similar to Java:
      • The case of identifiers is preserved no matter whether they are quoted.
      • Identifiers are matched case-sensitively.
      • Unlike Java, back-ticks allow identifiers to contain non-alphanumeric characters (for example, SELECT a AS `my field` FROM t).

      String text must be enclosed in single quotes (for example, SELECT'Hello World'). Duplicate a single quote for escaping (for example, SELECT'It''s me.'). Unicode characters are supported in string literals. If explicit Unicode points are required, use the following syntax:

      • Use the backslash (\) as an escaping character (default): SELECT U&'\263A'
      • Use a custom escaping character: SELECT U&'#263A' UESCAPE '#'
    1. Regular expression function (REGEXP) restrictions

      Regular expressions are time-consuming and require 100 times performance overhead as that for addition, subtraction, multiplication, and division. Beyond that, regular expressions may enter an infinite loop in some extreme cases, causing job blocking. So LIKE is recommended. Typical regular expression functions you may use include:

      REGEXP

      REGEXP_REPLACE

    2. WHERE condition pushdown is not supported for composite types or function-based conditions.

      WHERE condition pushdown optimization is not supported for the ARRAY, MAP, or ROW type, or function-based conditions. If the WHERE condition references fields of the ARRAY, MAP, or ROW type, or contains function-based conditions, the statement cannot be pushed down to the data source for execution. You are advised not to directly reference fields like ARRAY, MAP, or ROW type or use function-based conditions in the WHERE clause. Instead, you can reconstruct the query logic to convert these filters into scalar-type conditions that support pushdown.

    3. Table query restrictions
      • Restrictions on streaming table query: A maximum of 1,000 records in the last three days can be queried. The console displays a maximum of 200 records for the last three days.
      • Restrictions on index table query: A maximum of 10,000 records in a time range of no longer than seven days can be queried. The console displays a maximum of 200 records for a time range of no longer than seven days.
      • Restrictions on application table query: A maximum of 10,000 records in a time range of no longer than seven days can be queried. The console displays a maximum of 200 records for a time range of no longer than seven days.
      • Restrictions on complex statement query: When you use a join table statement for query, if there is no associated data in the same time range, no result is displayed. This is normal and does not indicate a query failure.
    4. SecMaster SQL query restrictions

      SecMaster supports only the query of defined data tables or pipeline fields. It does not support the query of undefined fields. If fields in raw logs are changed but the scenario is not defined in SecMaster, SecMaster SQL cannot be used to query the logs.