console: use Dst1stAS/Dst2ndAS/Dst3rdAS/DstASPath

DstASPath is not available in filters.

Makefile

@@ -99,7 +99,7 @@ console/frontend/node_modules: console/frontend/package.json console/frontend/pa
 console/frontend/node_modules: ; $(info $(M) fetching node modules…)
 	$Q (cd console/frontend ; npm ci --silent --no-audit --no-fund) && touch $@
 console/frontend/data/fields.json: console/query_consts.go ; $(info $(M) generate list of selectable fields…)
-	$Q sed -En -e 's/^\tqueryColumn([a-zA-Z]+)( .*|$$)/  "\1"/p' $< \
+	$Q sed -En -e 's/^\tqueryColumn([a-zA-Z0-9]+)( .*|$$)/  "\1"/p' $< \
 		| sed -E -e '$$ ! s/$$/,/' -e '1s/^ */[/' -e '$$s/$$/]/' > $@
 	$Q test -s $@
 console/data/frontend: console/frontend/node_modules

console/filter.go

@@ -163,15 +163,12 @@ func (c *Component) filterCompleteHandlerFunc(gc *gin.Context) {
 				filterCompletion{"PIM", "protocol", true},
 				filterCompletion{"IPv4", "protocol", true},
 				filterCompletion{"IPv6", "protocol", true})
-		case "srcas", "dstas":
+		case "srcas", "dstas", "dst1stas", "dst2ndas", "dst3rdas":
 			results := []struct {
 				Label  string `ch:"label"`
 				Detail string `ch:"detail"`
 			}{}
-			columnName := "SrcAS"
+			columnName := fixQueryColumnName(input.Column)
-			if strings.ToLower(input.Column) == "dstas" {
-				columnName = "DstAS"
-			}
 			sqlQuery := fmt.Sprintf(`
 SELECT label, detail FROM (
  SELECT concat('AS', toString(%s)) AS label, dictGet('asns', 'name', %s) AS detail, 1 AS rank
@@ -225,7 +222,7 @@ LIMIT 20`, attributeName, attributeName, attributeName), input.Prefix); err != n
 			}
 			input.Prefix = ""
 		case "exportername", "exportergroup", "exporterrole", "exportersite", "exporterregion", "exportertenant":
-			column = fmt.Sprintf("Exporter%s", helpers.Capitalize(inputColumn[8:]))
+			column = fixQueryColumnName(inputColumn)
 			detail = fmt.Sprintf("exporter %s", inputColumn[8:])
 		case "inifname", "outifname":
 			column = "IfName"

console/filter/parser.peg

@@ -134,7 +134,10 @@ ConditionPortExpr "condition on port" ←
 
 ConditionASExpr "condition on AS number" ←
  column:("SrcAS"i { return c.reverseColumnDirection("SrcAS"), nil }
-       / "DstAS"i { return c.reverseColumnDirection("DstAS"), nil }) _
+       / "DstAS"i { return c.reverseColumnDirection("DstAS"), nil }
+       / "Dst1stAS"i { return c.reverseColumnDirection("Dst1stAS"), nil }
+       / "Dst2ndAS"i { return c.reverseColumnDirection("Dst2ndAS"), nil }
+       / "Dst3rdAS"i { return c.reverseColumnDirection("Dst3rdAS"), nil }) _
  rcond:RConditionASExpr {
   return fmt.Sprintf("%s %s", toString(column), toString(rcond)), nil
 }

console/filter_test.go

@@ -116,6 +116,9 @@ UNION DISTINCT
 			StatusCode: 200,
 			JSONInput:  gin.H{"what": "column", "prefix": "dSt"},
 			JSONOutput: gin.H{"completions": []gin.H{
+				{"label": "Dst1stAS", "detail": "column name", "quoted": false},
+				{"label": "Dst2ndAS", "detail": "column name", "quoted": false},
+				{"label": "Dst3rdAS", "detail": "column name", "quoted": false},
 				{"label": "DstAS", "detail": "column name", "quoted": false},
 				{"label": "DstAddr", "detail": "column name", "quoted": false},
 				{"label": "DstCountry", "detail": "column name", "quoted": false},

console/frontend/src/codemirror/lang-filter/syntax.grammar

@@ -30,7 +30,7 @@ ListOfValues {
   blockCommentRest { ![*] blockCommentRest | "*" blockCommentAfterStar }
   blockCommentAfterStar { "/" | "*" blockCommentAfterStar | ![/*] blockCommentRest }
 
-  Column { std.asciiLetter+ }
+  Column { std.asciiLetter (std.asciiLetter|std.digit)* }
   Operator { $[a-zA-Z!=><]+ }
 
   String {

console/frontend/vite.config.js

@@ -23,7 +23,7 @@ export default defineConfig({
   server: {
     proxy: {
       "/api": {
-        target: "http://localhost:8080",
+        target: "http://127.0.0.1:8080",
         changeOrigin: true,
         headers: {
           "Remote-User": "alfred",

console/query.go

@@ -37,10 +37,11 @@ func (qc *queryColumn) UnmarshalText(input []byte) error {
 // queryColumnsRequiringMainTable lists query columns only present in
 // the main table. Also check filter/parser.peg.
 var queryColumnsRequiringMainTable = map[queryColumn]struct{}{
-	queryColumnSrcAddr: {},
+	queryColumnSrcAddr:   {},
-	queryColumnDstAddr: {},
+	queryColumnDstAddr:   {},
-	queryColumnSrcPort: {},
+	queryColumnSrcPort:   {},
-	queryColumnDstPort: {},
+	queryColumnDstPort:   {},
+	queryColumnDstASPath: {},
 }
 
 func requireMainTable(qcs []queryColumn, qf queryFilter) bool {
@@ -96,7 +97,7 @@ func (qc queryColumn) toSQLSelect() string {
 	switch qc {
 	case queryColumnExporterAddress, queryColumnSrcAddr, queryColumnDstAddr:
 		strValue = fmt.Sprintf("replaceRegexpOne(IPv6NumToString(%s), '^::ffff:', '')", qc)
-	case queryColumnSrcAS, queryColumnDstAS:
+	case queryColumnSrcAS, queryColumnDstAS, queryColumnDst1stAS, queryColumnDst2ndAS, queryColumnDst3rdAS:
 		strValue = fmt.Sprintf(`concat(toString(%s), ': ', dictGetOrDefault('asns', 'name', %s, '???'))`,
 			qc, qc)
 	case queryColumnEType:
@@ -106,6 +107,8 @@ func (qc queryColumn) toSQLSelect() string {
 		strValue = `dictGetOrDefault('protocols', 'name', Proto, '???')`
 	case queryColumnInIfSpeed, queryColumnOutIfSpeed, queryColumnSrcPort, queryColumnDstPort, queryColumnForwardingStatus, queryColumnInIfBoundary, queryColumnOutIfBoundary:
 		strValue = fmt.Sprintf("toString(%s)", qc)
+	case queryColumnDstASPath:
+		strValue = `arrayStringConcat(DstASPath, ' ')`
 	default:
 		strValue = qc.String()
 	}
@@ -120,3 +123,14 @@ func (qc queryColumn) reverseDirection() queryColumn {
 	}
 	return value
 }
+
+// fixQueryColumnName fix capitalization of the provided column name
+func fixQueryColumnName(name string) string {
+	name = strings.ToLower(name)
+	for _, target := range queryColumnMap.Values() {
+		if strings.ToLower(target) == name {
+			return target
+		}
+	}
+	return ""
+}

console/query_consts.go

@@ -31,6 +31,10 @@ const (
 	queryColumnSrcPort
 	queryColumnSrcAddr
 	queryColumnDstAS
+	queryColumnDstASPath
+	queryColumnDst1stAS
+	queryColumnDst2ndAS
+	queryColumnDst3rdAS
 	queryColumnDstNetName
 	queryColumnDstNetRole
 	queryColumnDstNetSite
@@ -61,6 +65,10 @@ var queryColumnMap = helpers.NewBimap(map[queryColumn]string{
 	queryColumnDstAddr:           "DstAddr",
 	queryColumnSrcAS:             "SrcAS",
 	queryColumnDstAS:             "DstAS",
+	queryColumnDstASPath:         "DstASPath",
+	queryColumnDst1stAS:          "Dst1stAS",
+	queryColumnDst2ndAS:          "Dst2ndAS",
+	queryColumnDst3rdAS:          "Dst3rdAS",
 	queryColumnSrcNetName:        "SrcNetName",
 	queryColumnDstNetName:        "DstNetName",
 	queryColumnSrcNetRole:        "SrcNetRole",

console/query_test.go

@@ -45,6 +45,9 @@ func TestQueryColumnSQLSelect(t *testing.T) {
 		}, {
 			Input:    queryColumnDstAS,
 			Expected: `concat(toString(DstAS), ': ', dictGetOrDefault('asns', 'name', DstAS, '???'))`,
+		}, {
+			Input:    queryColumnDst2ndAS,
+			Expected: `concat(toString(Dst2ndAS), ': ', dictGetOrDefault('asns', 'name', Dst2ndAS, '???'))`,
 		}, {
 			Input:    queryColumnProto,
 			Expected: `dictGetOrDefault('protocols', 'name', Proto, '???')`,
@@ -60,6 +63,9 @@ func TestQueryColumnSQLSelect(t *testing.T) {
 		}, {
 			Input:    queryColumnPacketSizeBucket,
 			Expected: `PacketSizeBucket`,
+		}, {
+			Input:    queryColumnDstASPath,
+			Expected: `arrayStringConcat(DstASPath, ' ')`,
 		},
 	}
 	for _, tc := range cases {

orchestrator/clickhouse/migrationsteps.go

@@ -691,7 +691,7 @@ func (c *Component) migrationStepCreateRawFlowsConsumerView(ctx context.Context,
 			l.Debug().Msg("create consumer table")
 			return conn.Exec(ctx, fmt.Sprintf(`
 CREATE MATERIALIZED VIEW %s TO flows
-AS SELECT
+AS WITH arrayCompact(DstASPath) AS c_DstASPath SELECT
  *,
  dictGetOrDefault('networks', 'name', SrcAddr, '') AS SrcNetName,
  dictGetOrDefault('networks', 'name', DstAddr, '') AS DstNetName,
@@ -703,9 +703,9 @@ AS SELECT
  dictGetOrDefault('networks', 'region', DstAddr, '') AS DstNetRegion,
  dictGetOrDefault('networks', 'tenant', SrcAddr, '') AS SrcNetTenant,
  dictGetOrDefault('networks', 'tenant', DstAddr, '') AS DstNetTenant,
- arrayCompact(DstASPath)[1] AS Dst1stAS,
+ c_DstASPath[1] AS Dst1stAS,
- arrayCompact(DstASPath)[2] AS Dst2ndAS,
+ c_DstASPath[2] AS Dst2ndAS,
- arrayCompact(DstASPath)[3] AS Dst3rdAS
+ c_DstASPath[3] AS Dst3rdAS
 FROM %s`, viewName, tableName))
 		},
 	}

orchestrator/clickhouse/testdata/states/008.csv

@@ -9,5 +9,5 @@
 "flows_1h0m0s","CREATE TABLE default.flows_1h0m0s (`TimeReceived` DateTime CODEC(DoubleDelta, LZ4), `SamplingRate` UInt64, `ExporterAddress` LowCardinality(IPv6), `ExporterName` LowCardinality(String), `ExporterGroup` LowCardinality(String), `ExporterRole` LowCardinality(String), `ExporterSite` LowCardinality(String), `ExporterRegion` LowCardinality(String), `ExporterTenant` LowCardinality(String), `SrcAS` UInt32, `DstAS` UInt32, `SrcNetName` LowCardinality(String), `DstNetName` LowCardinality(String), `SrcNetRole` LowCardinality(String), `DstNetRole` LowCardinality(String), `SrcNetSite` LowCardinality(String), `DstNetSite` LowCardinality(String), `SrcNetRegion` LowCardinality(String), `DstNetRegion` LowCardinality(String), `SrcNetTenant` LowCardinality(String), `DstNetTenant` LowCardinality(String), `SrcCountry` FixedString(2), `DstCountry` FixedString(2), `Dst1stAS` UInt32, `Dst2ndAS` UInt32, `Dst3rdAS` UInt32, `InIfName` LowCardinality(String), `OutIfName` LowCardinality(String), `InIfDescription` String, `OutIfDescription` String, `InIfSpeed` UInt32, `OutIfSpeed` UInt32, `InIfConnectivity` LowCardinality(String), `OutIfConnectivity` LowCardinality(String), `InIfProvider` LowCardinality(String), `OutIfProvider` LowCardinality(String), `InIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `OutIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `EType` UInt32, `Proto` UInt32, `Bytes` UInt64, `Packets` UInt64, `PacketSize` UInt64 ALIAS intDiv(Bytes, Packets), `PacketSizeBucket` LowCardinality(String) ALIAS multiIf(PacketSize < 64, '0-63', PacketSize < 128, '64-127', PacketSize < 256, '128-255', PacketSize < 512, '256-511', PacketSize < 768, '512-767', PacketSize < 1024, '768-1023', PacketSize < 1280, '1024-1279', PacketSize < 1501, '1280-1500', PacketSize < 2048, '1501-2047', PacketSize < 3072, '2048-3071', PacketSize < 4096, '3072-4095', PacketSize < 8192, '4096-8191', PacketSize < 10240, '8192-10239', PacketSize < 16384, '10240-16383', PacketSize < 32768, '16384-32767', PacketSize < 65536, '32768-65535', '65536-Inf'), `ForwardingStatus` UInt32) ENGINE = SummingMergeTree((Bytes, Packets)) PARTITION BY toYYYYMMDDhhmmss(toStartOfInterval(TimeReceived, toIntervalSecond(622080))) PRIMARY KEY (TimeReceived, ExporterAddress, EType, Proto, InIfName, SrcAS, ForwardingStatus, OutIfName, DstAS, SamplingRate) ORDER BY (TimeReceived, ExporterAddress, EType, Proto, InIfName, SrcAS, ForwardingStatus, OutIfName, DstAS, SamplingRate, SrcNetName, DstNetName, SrcNetRole, DstNetRole, SrcNetSite, DstNetSite, SrcNetRegion, DstNetRegion, SrcNetTenant, DstNetTenant, SrcCountry, DstCountry, `Dst1stAS`, `Dst2ndAS`, `Dst3rdAS`) TTL TimeReceived + toIntervalSecond(31104000) SETTINGS index_granularity = 8192"
 "flows_1m0s_consumer","CREATE MATERIALIZED VIEW default.flows_1m0s_consumer TO default.flows_1m0s (`TimeReceived` DateTime, `SamplingRate` UInt64, `ExporterAddress` LowCardinality(IPv6), `ExporterName` LowCardinality(String), `ExporterGroup` LowCardinality(String), `ExporterRole` LowCardinality(String), `ExporterSite` LowCardinality(String), `ExporterRegion` LowCardinality(String), `ExporterTenant` LowCardinality(String), `SrcAS` UInt32, `DstAS` UInt32, `SrcNetName` LowCardinality(String), `DstNetName` LowCardinality(String), `SrcNetRole` LowCardinality(String), `DstNetRole` LowCardinality(String), `SrcNetSite` LowCardinality(String), `DstNetSite` LowCardinality(String), `SrcNetRegion` LowCardinality(String), `DstNetRegion` LowCardinality(String), `SrcNetTenant` LowCardinality(String), `DstNetTenant` LowCardinality(String), `SrcCountry` FixedString(2), `DstCountry` FixedString(2), `Dst1stAS` UInt32, `Dst2ndAS` UInt32, `Dst3rdAS` UInt32, `InIfName` LowCardinality(String), `OutIfName` LowCardinality(String), `InIfDescription` String, `OutIfDescription` String, `InIfSpeed` UInt32, `OutIfSpeed` UInt32, `InIfConnectivity` LowCardinality(String), `OutIfConnectivity` LowCardinality(String), `InIfProvider` LowCardinality(String), `OutIfProvider` LowCardinality(String), `InIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `OutIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `EType` UInt32, `Proto` UInt32, `Bytes` UInt64, `Packets` UInt64, `ForwardingStatus` UInt32) AS SELECT * EXCEPT (SrcAddr, DstAddr, SrcPort, DstPort, DstASPath) REPLACE toStartOfInterval(TimeReceived, toIntervalSecond(60)) AS TimeReceived FROM default.flows"
 "flows_5m0s_consumer","CREATE MATERIALIZED VIEW default.flows_5m0s_consumer TO default.flows_5m0s (`TimeReceived` DateTime, `SamplingRate` UInt64, `ExporterAddress` LowCardinality(IPv6), `ExporterName` LowCardinality(String), `ExporterGroup` LowCardinality(String), `ExporterRole` LowCardinality(String), `ExporterSite` LowCardinality(String), `ExporterRegion` LowCardinality(String), `ExporterTenant` LowCardinality(String), `SrcAS` UInt32, `DstAS` UInt32, `SrcNetName` LowCardinality(String), `DstNetName` LowCardinality(String), `SrcNetRole` LowCardinality(String), `DstNetRole` LowCardinality(String), `SrcNetSite` LowCardinality(String), `DstNetSite` LowCardinality(String), `SrcNetRegion` LowCardinality(String), `DstNetRegion` LowCardinality(String), `SrcNetTenant` LowCardinality(String), `DstNetTenant` LowCardinality(String), `SrcCountry` FixedString(2), `DstCountry` FixedString(2), `Dst1stAS` UInt32, `Dst2ndAS` UInt32, `Dst3rdAS` UInt32, `InIfName` LowCardinality(String), `OutIfName` LowCardinality(String), `InIfDescription` String, `OutIfDescription` String, `InIfSpeed` UInt32, `OutIfSpeed` UInt32, `InIfConnectivity` LowCardinality(String), `OutIfConnectivity` LowCardinality(String), `InIfProvider` LowCardinality(String), `OutIfProvider` LowCardinality(String), `InIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `OutIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `EType` UInt32, `Proto` UInt32, `Bytes` UInt64, `Packets` UInt64, `ForwardingStatus` UInt32) AS SELECT * EXCEPT (SrcAddr, DstAddr, SrcPort, DstPort, DstASPath) REPLACE toStartOfInterval(TimeReceived, toIntervalSecond(300)) AS TimeReceived FROM default.flows"
-"flows_3_raw_consumer","CREATE MATERIALIZED VIEW default.flows_3_raw_consumer TO default.flows (`TimeReceived` DateTime, `SamplingRate` UInt64, `ExporterAddress` LowCardinality(IPv6), `ExporterName` LowCardinality(String), `ExporterGroup` LowCardinality(String), `ExporterRole` LowCardinality(String), `ExporterSite` LowCardinality(String), `ExporterRegion` LowCardinality(String), `ExporterTenant` LowCardinality(String), `SrcAddr` IPv6, `DstAddr` IPv6, `SrcAS` UInt32, `DstAS` UInt32, `SrcCountry` FixedString(2), `DstCountry` FixedString(2), `DstASPath` Array(UInt32), `InIfName` LowCardinality(String), `OutIfName` LowCardinality(String), `InIfDescription` String, `OutIfDescription` String, `InIfSpeed` UInt32, `OutIfSpeed` UInt32, `InIfConnectivity` LowCardinality(String), `OutIfConnectivity` LowCardinality(String), `InIfProvider` LowCardinality(String), `OutIfProvider` LowCardinality(String), `InIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `OutIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `EType` UInt32, `Proto` UInt32, `SrcPort` UInt32, `DstPort` UInt32, `Bytes` UInt64, `Packets` UInt64, `ForwardingStatus` UInt32, `SrcNetName` String, `DstNetName` String, `SrcNetRole` String, `DstNetRole` String, `SrcNetSite` String, `DstNetSite` String, `SrcNetRegion` String, `DstNetRegion` String, `SrcNetTenant` String, `DstNetTenant` String, `Dst1stAS` UInt32, `Dst2ndAS` UInt32, `Dst3rdAS` UInt32) AS SELECT *, dictGetOrDefault('default.networks', 'name', SrcAddr, '') AS SrcNetName, dictGetOrDefault('default.networks', 'name', DstAddr, '') AS DstNetName, dictGetOrDefault('default.networks', 'role', SrcAddr, '') AS SrcNetRole, dictGetOrDefault('default.networks', 'role', DstAddr, '') AS DstNetRole, dictGetOrDefault('default.networks', 'site', SrcAddr, '') AS SrcNetSite, dictGetOrDefault('default.networks', 'site', DstAddr, '') AS DstNetSite, dictGetOrDefault('default.networks', 'region', SrcAddr, '') AS SrcNetRegion, dictGetOrDefault('default.networks', 'region', DstAddr, '') AS DstNetRegion, dictGetOrDefault('default.networks', 'tenant', SrcAddr, '') AS SrcNetTenant, dictGetOrDefault('default.networks', 'tenant', DstAddr, '') AS DstNetTenant, arrayCompact(DstASPath)[1] AS `Dst1stAS`, arrayCompact(DstASPath)[2] AS `Dst2ndAS`, arrayCompact(DstASPath)[3] AS `Dst3rdAS` FROM default.flows_3_raw"
+"flows_3_raw_consumer","CREATE MATERIALIZED VIEW default.flows_3_raw_consumer TO default.flows (`TimeReceived` DateTime, `SamplingRate` UInt64, `ExporterAddress` LowCardinality(IPv6), `ExporterName` LowCardinality(String), `ExporterGroup` LowCardinality(String), `ExporterRole` LowCardinality(String), `ExporterSite` LowCardinality(String), `ExporterRegion` LowCardinality(String), `ExporterTenant` LowCardinality(String), `SrcAddr` IPv6, `DstAddr` IPv6, `SrcAS` UInt32, `DstAS` UInt32, `SrcCountry` FixedString(2), `DstCountry` FixedString(2), `DstASPath` Array(UInt32), `InIfName` LowCardinality(String), `OutIfName` LowCardinality(String), `InIfDescription` String, `OutIfDescription` String, `InIfSpeed` UInt32, `OutIfSpeed` UInt32, `InIfConnectivity` LowCardinality(String), `OutIfConnectivity` LowCardinality(String), `InIfProvider` LowCardinality(String), `OutIfProvider` LowCardinality(String), `InIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `OutIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `EType` UInt32, `Proto` UInt32, `SrcPort` UInt32, `DstPort` UInt32, `Bytes` UInt64, `Packets` UInt64, `ForwardingStatus` UInt32, `SrcNetName` String, `DstNetName` String, `SrcNetRole` String, `DstNetRole` String, `SrcNetSite` String, `DstNetSite` String, `SrcNetRegion` String, `DstNetRegion` String, `SrcNetTenant` String, `DstNetTenant` String, `Dst1stAS` UInt32, `Dst2ndAS` UInt32, `Dst3rdAS` UInt32) AS WITH arrayCompact(DstASPath) AS c_DstASPath SELECT *, dictGetOrDefault('default.networks', 'name', SrcAddr, '') AS SrcNetName, dictGetOrDefault('default.networks', 'name', DstAddr, '') AS DstNetName, dictGetOrDefault('default.networks', 'role', SrcAddr, '') AS SrcNetRole, dictGetOrDefault('default.networks', 'role', DstAddr, '') AS DstNetRole, dictGetOrDefault('default.networks', 'site', SrcAddr, '') AS SrcNetSite, dictGetOrDefault('default.networks', 'site', DstAddr, '') AS DstNetSite, dictGetOrDefault('default.networks', 'region', SrcAddr, '') AS SrcNetRegion, dictGetOrDefault('default.networks', 'region', DstAddr, '') AS DstNetRegion, dictGetOrDefault('default.networks', 'tenant', SrcAddr, '') AS SrcNetTenant, dictGetOrDefault('default.networks', 'tenant', DstAddr, '') AS DstNetTenant, c_DstASPath[1] AS `Dst1stAS`, c_DstASPath[2] AS `Dst2ndAS`, c_DstASPath[3] AS `Dst3rdAS` FROM default.flows_3_raw"
 "flows_1h0m0s_consumer","CREATE MATERIALIZED VIEW default.flows_1h0m0s_consumer TO default.flows_1h0m0s (`TimeReceived` DateTime, `SamplingRate` UInt64, `ExporterAddress` LowCardinality(IPv6), `ExporterName` LowCardinality(String), `ExporterGroup` LowCardinality(String), `ExporterRole` LowCardinality(String), `ExporterSite` LowCardinality(String), `ExporterRegion` LowCardinality(String), `ExporterTenant` LowCardinality(String), `SrcAS` UInt32, `DstAS` UInt32, `SrcNetName` LowCardinality(String), `DstNetName` LowCardinality(String), `SrcNetRole` LowCardinality(String), `DstNetRole` LowCardinality(String), `SrcNetSite` LowCardinality(String), `DstNetSite` LowCardinality(String), `SrcNetRegion` LowCardinality(String), `DstNetRegion` LowCardinality(String), `SrcNetTenant` LowCardinality(String), `DstNetTenant` LowCardinality(String), `SrcCountry` FixedString(2), `DstCountry` FixedString(2), `Dst1stAS` UInt32, `Dst2ndAS` UInt32, `Dst3rdAS` UInt32, `InIfName` LowCardinality(String), `OutIfName` LowCardinality(String), `InIfDescription` String, `OutIfDescription` String, `InIfSpeed` UInt32, `OutIfSpeed` UInt32, `InIfConnectivity` LowCardinality(String), `OutIfConnectivity` LowCardinality(String), `InIfProvider` LowCardinality(String), `OutIfProvider` LowCardinality(String), `InIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `OutIfBoundary` Enum8('undefined' = 0, 'external' = 1, 'internal' = 2), `EType` UInt32, `Proto` UInt32, `Bytes` UInt64, `Packets` UInt64, `ForwardingStatus` UInt32) AS SELECT * EXCEPT (SrcAddr, DstAddr, SrcPort, DstPort, DstASPath) REPLACE toStartOfInterval(TimeReceived, toIntervalSecond(3600)) AS TimeReceived FROM default.flows"