CSE仪表盘模板

前提条件

• 已采集CSE日志。
• 日志配置结构化，详情请参见设置云端结构化解析日志。

查看CSE层级访问中心

1. 登录云日志服务控制台，在左侧导航栏中选择“仪表盘 ”。
2. 在仪表盘模板下方，选择“CSE仪表盘模板 > CSE层访问中心”，查看图表详情。
   • 过滤上游IP，所关联的查询分析语句如下所示：

     select distinct(upstream_host)
   • 过滤调用链trace_id，所关联的查询分析语句如下所示：

     select distinct(trace_id)
   • PV对比昨日图表所关联的查询分析语句如下所示：

     select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "pv" , 86400) as diff from (select count(1) as "pv" from log))
   • PV对比上周图表所关联的查询分析语句如下所示

     select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "pv" , 604800) as diff from (select count(1) as "pv" from log))
   • UV对比昨日图表所关联的查询分析语句如下所示：

     select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "uv" , 86400) as diff from (select APPROX_COUNT_DISTINCT(authority) as "uv" from log))
   • UV对比上周图表所关联的查询分析语句如下所示：

     select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "uv" , 604800) as diff from (select APPROX_COUNT_DISTINCT(authority) as "uv" from log))
   • 访问量PV分布(中国)图表所关联的查询分析语句如下所示：

     select ip_to_province(authority) as province, sum(ori_pv) as pv from (select authority, count(1) as ori_pv   group by authority   ORDER BY ori_pv desc  LIMIT 10000)  where IP_TO_COUNTRY (authority) = '中国'  group by province HAVING province not in ('','保留地址','*')
   • 访问量PV分布(世界)图表所关联的查询分析语句如下所示：

     SELECT ip_to_country(authority) as country,sum(ori_pv) as PV from (select authority, count(1) as ori_pv  group by authority   ORDER BY ori_pv desc  LIMIT 10000) GROUP BY country HAVING country not in ('','保留地址','*')
   • 平均时延分布（中国）图表所关联的查询分析语句如下所示：

     SELECT province,round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)" FROM (SELECT ip_to_province(authority) as province,sum(rt)/sum(ori_pv) * 1000 AS "平均延迟(ms)" from (select authority, sum(duration) as rt,count(1) as ori_pv  group by authority   ORDER BY ori_pv desc   LIMIT 10000) WHERE  IP_TO_COUNTRY (authority) = '中国' GROUP BY province )  where province not in ('','保留地址','*')
   • 平均时延分布（世界）图表所关联的查询分析语句如下所示：

     SELECT country,round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 2 ) AS "平均延迟(ms)" FROM (SELECT ip_to_country(authority) as country,sum(rt)/sum(ori_pv)  * 1000 AS "平均延迟(ms)" from (select authority, sum(duration) as rt,count(1) as ori_pv   group by authority   ORDER BY ori_pv desc LIMIT 10000) GROUP BY country ) where  country not in ('','保留地址','*')
   • 今日PV/UV图表所关联的查询分析语句如下所示：

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,PV,UV FROM (select TIME_CEIL(TIME_PARSE(start_time),'PT600S') AS _time_ , count(1) as PV,  APPROX_COUNT_DISTINCT(authority) as UV from log WHERE __time <= CURRENT_TIMESTAMP  and __time >= DATE_TRUNC( 'DAY',(CURRENT_TIMESTAMP + INTERVAL '8' HOUR)) - INTERVAL '8' HOUR group by _time_ order by _time_)
   • 区域访问TOP10(省份)图表所关联的查询分析语句如下所示：

     select ip_to_province(authority) as "province", sum(ori_pv) as "访问次数" from (select authority, count(1) as ori_pv  group by authority  ORDER BY ori_pv desc  LIMIT 10000) group by "province" HAVING "province" <> '-1' order by "访问次数" desc limit 10
   • 区域访问TOP10(城市)图表所关联的查询分析语句如下所示：

     select ip_to_city(authority) as "city", sum(ori_pv) as "访问次数" from (select authority, count(1) as ori_pv  group by authority ORDER BY ori_pv desc LIMIT 10000) group by "city" HAVING  "city" <> '-1' order by "访问次数" desc  limit 10
   • Host访问TOP10图表所关联的查询分析语句如下所示：

     select  upstream_host as "Host", count(1) as "PV" group by "Host" order by "PV" desc limit 10
   • UserAgent访问TOP10图表所关联的查询分析语句如下所示：

     select user_agent as "UserAgent", count(1) as "PV" group by "UserAgent" order by "PV" desc limit 10
   • 设备占比(终端)图表所关联的查询分析语句如下所示：

     select case when regexp_like(lower(user_agent), 'iphone|ipod|android|ios') then '移动端' else 'PC端' end as type , count(1) as total group by  type
   • 设备占比(系统)图表所关联的查询分析语句如下所示：

     select case when regexp_like(lower(user_agent), 'iphone|ipod|ios') then 'IOS' when regexp_like(lower(user_agent), 'android') then 'Android' else 'other' end as type , count(1) as total group by  type HAVING type != 'other'
   • TOP URL图表所关联的查询分析语句如下所示：

     select path , count(1) as pv, APPROX_COUNT_DISTINCT(authority) as UV, round(sum( case when response_code < 400 then 1 else 0 end   )  * 100.0 / count(1), 2) as "访问成功率" group by path ORDER by pv desc
   • TOP 访问IP图表所关联的查询分析语句如下所示：

     select authority as "来源IP",ip_to_country(authority) as "国家",ip_to_province(authority) as "省份",ip_to_city(authority) as "城市",ip_to_provider(authority) as "运营商",count(1) as "PV" group by authority ORDER by "PV" desc limit 100

查看CSE层级监控中心

1. 登录云日志服务控制台，在左侧导航栏中选择“仪表盘 ”。
2. 在仪表盘模板下方，选择“CSE仪表盘模板 > CSE层监控中心”，查看图表详情。
   • 过滤上游IP，所关联的查询分析语句如下所示：

     select distinct(upstream_host)
   • 过滤调用链trace_id，所关联的查询分析语句如下所示：

     select distinct(trace_id)
   • 访问量PV图表所关联的查询分析语句如下所示：

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,PV FROM ( SELECT TIME_CEIL ( TIME_PARSE(start_time), 'PT300S' ) AS _time_, count( 1 ) AS PV FROM log GROUP BY _time_ )
   • 请求成功率图表所关联的查询分析语句如下所示：

     select ROUND(sum(case when response_code < 400 then 1 else 0 end) * 100.0 / count(1),2) as cnt
   • 平均延迟图表所关联的查询分析语句如下所示：

     select round(avg(duration) * 1000, 3) as cnt
   • 4XX请求数图表所关联的查询分析语句如下所示：

     SELECT COUNT(1) as cnt WHERE "response_code" >= 400 and "response_code" < 500
   • 404请求数图表所关联的查询分析语句如下所示：

     SELECT COUNT(1) as cnt WHERE "response_code" = 404
   • 429请求数图表所关联的查询分析语句如下所示：

     SELECT COUNT(1) as cnt WHERE "response_code" = 429
   • 504请求数图表所关联的查询分析语句如下所示：

     SELECT COUNT(1) as cnt WHERE "response_code" = 504
   • 5XX请求数图表所关联的查询分析语句如下所示：

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,cnt FROM ( SELECT TIME_CEIL ( TIME_PARSE(start_time), 'PT300S' ) AS _time_, count( 1 ) AS cnt FROM log where "response_code" >= 500 GROUP BY _time_ )
   • 状态码分布图表所关联的查询分析语句如下所示：

     SELECT response_code, COUNT(1) AS rm GROUP BY response_code
   • 访问量UV图表所关联的查询分析语句如下所示：

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,UV FROM (select TIME_CEIL(TIME_PARSE(start_time),'PT600S') AS _time_ , APPROX_COUNT_DISTINCT(authority) as UV  from log group by _time_)
   • 流量图表所关联的查询分析语句如下所示：

     select TIME_FORMAT(_time_,'yyyy-MM-dd HH:mm:ss') AS _time_,round( CASE WHEN "入流量" > 0 THEN "入流量" ELSE 0 END, 2 ) AS "入流量",round( CASE WHEN "出流量" > 0 THEN "出流量" ELSE 0 END, 2 ) AS "出流量" FROM (SELECT TIME_CEIL(TIME_PARSE(start_time),'PT600S') AS _time_,sum(bytes_received) / 1024.0 AS "入流量",sum(bytes_sent) / 1024.0 AS "出流量" group by  _time_)
   • 访问失败率图表所关联的查询分析语句如下所示：

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,round( CASE WHEN "失败率" > 0 THEN "失败率" ELSE 0 END, 2 ) AS "失败率",round( CASE WHEN "5XX比例" > 0 THEN "5XX比例" ELSE 0 END, 2 ) AS "5XX比例" from (select TIME_CEIL(TIME_PARSE(start_time),'PT600S') AS _time_,sum(case when response_code >= 400 then 1 else 0 end) * 100.0 / count(1) as '失败率' , sum(case when response_code >=500 THEN 1 ELSE 0 END)*100.0/COUNT(1) as '5XX比例' group by  _time_)
   • 延迟图表所关联的查询分析语句如下所示：

     select TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,round( CASE WHEN "平均" > 0 THEN "平均" ELSE 0 END, 2 ) AS "平均",round( CASE WHEN "P50" > 0 THEN "P50" ELSE 0 END, 2 ) AS "P50",round( CASE WHEN "P90" > 0 THEN "P90" ELSE 0 END, 2 ) AS "P90",round( CASE WHEN "P99" > 0 THEN "P99" ELSE 0 END, 2 ) AS "P99",round( CASE WHEN "P9999" > 0 THEN "P9999" ELSE 0 END, 2 ) AS "P9999" from (select TIME_CEIL(TIME_PARSE(start_time),'PT600S') as _time_,avg(duration) * 1000 as "平均", APPROX_QUANTILE_DS("duration", 0.50)*1000 as "P50", APPROX_QUANTILE_DS("duration", 0.90)*1000 as "P90" ,APPROX_QUANTILE_DS("duration", 0.99)*1000 as 'P99',APPROX_QUANTILE_DS("duration", 0.9999)*1000 as 'P9999' group by  _time_)
   • Host请求TOP图表所关联的查询分析语句如下所示：

     SELECT "upstream_host", pv, uv, round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "入流量(KB)" > 0 THEN "入流量(KB)" ELSE 0 END, 3 ) AS "入流量(KB)", round( CASE WHEN "出流量(KB)" > 0 THEN "出流量(KB)" ELSE 0 END, 3 ) AS "出流量(KB)"  FROM ( SELECT "upstream_host", count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( authority ) AS uv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( duration ) * 1000 AS "平均延迟(ms)", sum( bytes_received ) / 1024.0 AS "入流量(KB)", sum( bytes_sent ) / 1024.0 AS "出流量(KB)"  WHERE "upstream_host" != ''  GROUP BY "upstream_host" ) ORDER BY pv DESC
   • Host延迟TOP图表所关联的查询分析语句如下所示：

     SELECT "upstream_host", pv, round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)", round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)" FROM ( SELECT "upstream_host", count( 1 ) AS pv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( duration ) * 1000 AS "平均延迟(ms)",APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99延迟(ms)" WHERE "upstream_host" != ''  GROUP BY "upstream_host" ) ORDER BY "平均延迟(ms)" desc
   • Host失败率TOP图表所关联的查询分析语句如下所示：

     SELECT "upstream_host", pv,round( CASE WHEN "访问失败率(%)" > 0 THEN "访问失败率(%)" ELSE 0 END, 2 ) AS "访问失败率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)", round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)"  FROM ( SELECT "upstream_host", count( 1 ) AS pv, sum( CASE WHEN "response_code" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问失败率(%)", avg( duration ) * 1000 AS "平均延迟(ms)", APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99延迟(ms)" WHERE "upstream_host" != ''  GROUP BY "upstream_host") ORDER BY "访问失败率(%)" desc
   • URL请求TOP图表所关联的查询分析语句如下所示：

     SELECT path, pv,uv, round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "入流量(KB)" > 0 THEN "入流量(KB)" ELSE 0 END, 3 ) AS "入流量(KB)", round( CASE WHEN "出流量(KB)" > 0 THEN "出流量(KB)" ELSE 0 END, 3 ) AS "出流量(KB)"  FROM ( SELECT path, count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( authority ) AS uv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( duration ) * 1000 AS "平均延迟(ms)", sum( bytes_received ) / 1024.0 AS "入流量(KB)", sum( bytes_sent ) / 1024.0 AS "出流量(KB)"  WHERE "upstream_host" != ''  GROUP BY path  ) ORDER BY pv desc
   • URL失败率TOP图表所关联的查询分析语句如下所示：

     SELECT path, pv, round( CASE WHEN "访问失败率(%)" > 0 THEN "访问失败率(%)" ELSE 0 END, 2 ) AS "访问失败率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)", round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)" FROM( SELECT path, count( 1 ) AS pv, sum( CASE WHEN "response_code" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问失败率(%)", avg( duration ) * 1000 AS "平均延迟(ms)", APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99延迟(ms)" WHERE "upstream_host" != '' GROUP BY path  ) ORDER BY "访问失败率(%)" desc
   • 后端请求TOP图表所关联的查询分析语句如下所示：

     SELECT addr, pv, uv, round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "入流量(KB)" > 0 THEN "入流量(KB)" ELSE 0 END, 3 ) AS "入流量(KB)", round( CASE WHEN "出流量(KB)" > 0 THEN "出流量(KB)" ELSE 0 END, 3 ) AS "出流量(KB)"  FROM ( SELECT authority as addr, count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( authority ) AS uv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( duration ) * 1000 AS "平均延迟(ms)", sum( bytes_received ) / 1024.0 AS "入流量(KB)", sum( bytes_sent ) / 1024.0 AS "出流量(KB)"  WHERE "upstream_host" != ''  GROUP BY addr  having length(authority) > 2) ORDER BY "pv" desc
   • 后端延迟TOP图表所关联的查询分析语句如下所示：

     SELECT addr,pv,round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)",round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)",round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)",round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)" FROM (SELECT authority as addr,count( 1 ) AS pv,sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)",avg( duration ) * 1000 AS "平均延迟(ms)",APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90延迟(ms)",APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99延迟(ms)" WHERE "upstream_host" != '' and "authority" != '-' GROUP BY addr ) ORDER BY "平均延迟(ms)" desc
   • 后端失败率TOP图表所关联的查询分析语句如下所示：

     SELECT addr, pv, round( CASE WHEN "访问失败率(%)" > 0 THEN "访问失败率(%)" ELSE 0 END, 2 ) AS "访问失败率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)", round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)"  FROM ( SELECT authority as addr, count( 1 ) AS pv, sum( CASE WHEN "response_code" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问失败率(%)", avg( duration ) * 1000 AS "平均延迟(ms)", APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99延迟(ms)" WHERE "upstream_host" != '' and "authority" != '-' GROUP BY addr) ORDER BY "访问失败率(%)" desc
   • URL延迟TOP图表所关联的查询分析语句如下所示：

     SELECT path, pv,round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)",round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)",round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)",round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)" FROM (SELECT path, count( 1 ) AS pv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( duration ) * 1000 AS "平均延迟(ms)", APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99延迟(ms)" WHERE "upstream_host" != ''  GROUP BY path  ) ORDER BY "平均延迟(ms)" desc

查看CSE层级秒级监控

1. 登录云日志服务控制台，在左侧导航栏中选择“仪表盘 ”。
2. 在仪表盘模板下方，选择“CSE仪表盘模板 > CSE层秒级监控”，查看图表详情。
   • 过滤上游IP，所关联的查询分析语句如下所示：

     select distinct(upstream_host)
   • 过滤调用链trace_id，所关联的查询分析语句如下所示：

     select distinct(trace_id)
   • QPS图表所关联的查询分析语句如下所示：

     SELECT TIME_FORMAT(TIME_CEIL(TIME_PARSE(start_time),'PT5S'),'yyyy-MM-dd HH:mm:ss') AS _time_ , COUNT(*) as QPS from log group by _time_
   • 成功率图表所关联的查询分析语句如下所示：

     select __time,round(CASE WHEN "成功率" > 0 THEN "成功率" else 0 end,2) as "成功率" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(start_time),'PT5S'),'yyyy-MM-dd HH:mm:ss') as __time, sum(case when response_code < 400 then 1 else 0 end) * 100.0 / count(1) as '成功率' from log group by __time)
   • 延迟图表所关联的查询分析语句如下所示：

     select __time,round(CASE WHEN "访问延迟" > 0 THEN "访问延迟" else 0 end,2) as "访问延迟",round(CASE WHEN "Upstream延迟" > 0 THEN "Upstream延迟" else 0 end,2) as "Upstream延迟" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(start_time),'PT5S'),'yyyy-MM-dd HH:mm:ss') as __time, avg(duration)* 1000 as '访问延迟',avg(upstream_service_time)* 1000 as 'Upstream延迟' from log group by __time)
   • 流量图表所关联的查询分析语句如下所示：

     select __time,round( CASE WHEN "请求流量" > 0 THEN "请求流量" ELSE 0 END, 3 ) AS "请求流量",round( CASE WHEN "返回body流量" > 0 THEN "返回body流量" ELSE 0 END, 3 ) AS "返回body流量" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(start_time),'PT5S'),'yyyy-MM-dd HH:mm:ss') as __time , sum("bytes_received") / 1024.0 as "请求流量", sum("bytes_sent") / 1024.0 as "返回body流量" group by __time)
   • 状态码图表所关联的查询分析语句如下所示：

     SELECT TIME_CEIL ( TIME_PARSE ( start_time ), 'PT5S' ) AS "time", SUM( CASE WHEN "response_code" >= 200 AND "response_code" < 300 THEN 1 ELSE 0 END ) AS "2XX", SUM( CASE WHEN "response_code" >= 300 AND "response_code" < 400 THEN 1 ELSE 0 END ) AS "3XX", SUM( CASE WHEN "response_code" >= 400 AND "response_code" < 500 THEN 1 ELSE 0 END ) AS "4XX", SUM( CASE WHEN "response_code" >= 500 AND "response_code" < 600 THEN 1 ELSE 0 END ) AS "5XX", SUM( CASE WHEN "response_code" < 200 OR "response_code" >= 600 THEN 1 ELSE 0 END ) AS "其他" FROM log  WHERE TIME_PARSE ( start_time ) IS NOT NULL GROUP BY "time"  ORDER BY "time" ASC LIMIT 100000