ntc 修改clickhouse表

2 files changed, 2090 insertions, 7 deletions

diff --git a/NTC/clickhouse-ntc.txt b/NTC/clickhouse-ntc.txt
new file mode 100644
index 0000000..530c03c
--- /dev/null
+++ b/NTC/clickhouse-ntc.txt
@@ -0,0 +1,2086 @@
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_collect_radius_log_local ON CLUSTER ck_cluster (
+    log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	code Int64,
+	nas_ip String,
+	framed_ip String,
+	account String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY (found_time,service);
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_conn_record_log_local ON CLUSTER ck_cluster (
+    log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	app_label String,
+	c2s_pkt_num Int64,
+	s2c_pkt_num Int64,
+	c2s_byte_num Int64,
+	s2c_byte_num Int64,
+    proto_id Int64,
+    app_id Int64,
+    os_id Int64,
+    bs_id Int64,
+    web_id Int64,
+    behav_id Int64
+
+) ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY (found_time,service,cap_ip,d_ip,s_ip,entrance_id,direction);
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_collect_voip_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	pid String,
+	found_time Int64,
+	recv_time Int64,
+	cap_ip String,
+	voip_protocol String,
+	rtp_d_ip String,
+	rtp_s_ip String,
+	rtp_d_port Int64,
+	rtp_s_port Int64,
+	from_to_store_ip String,
+	from_to_store_url String,
+	to_from_store_ip String,
+	to_from_store_url String,
+	duation String,
+	sip_d_ip String,
+	sip_s_ip String,
+	sip_d_port Int64,
+	sip_s_port Int64,
+	call_id String,
+	request_uri String,
+	calling_account String,
+	called_account String,
+	contacts String,
+	via String,
+	route String,
+	record_route String,
+	user_agent String,
+	server String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_collect_ssl_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	version String,
+	sni String,
+	san String,
+	cn String,
+	individual_cert_file String,
+	middle_cert_file String,
+	root_cert_file String,
+	chain_cert_file String
+) ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY (found_time,service,cap_ip,d_ip,s_ip,entrance_id,direction);
+
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_collect_http_log_local ON CLUSTER ck_cluster (
+	found_time Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	http_seq Int64,
+	proxy_flag Int64,
+	device_id Int64,
+	isn Int64,
+	url String,
+	referer String,
+	entrance_id Int64
+) ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY (found_time,d_ip,s_ip);
+
+
+
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_reject_url_statistic_local ON CLUSTER ck_cluster
+(
+    url String,
+    website String,
+    ip_addr String,
+    sum Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree
+PARTITION BY toYYYYMMDD(stat_time)
+ORDER BY (stat_time, url);
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_network_traffic_stat_local ON CLUSTER ck_cluster
+(
+    addr_type String,
+    trans_type Int64,
+    entrance_id Int64,
+    device_id Int64,
+    direction Int64,
+    app_id Int64,
+    proto_id Int64,
+    domain_id Int64,
+    os_id Int64,
+    bs_id Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_network_traffic_stat_hour_local ON CLUSTER ck_cluster
+(
+    addr_type String,
+    trans_type Int64,
+    entrance_id Int64,
+    device_id Int64,
+    direction Int64,
+    app_id Int64,
+    proto_id Int64,
+    domain_id Int64,
+    os_id Int64,
+    bs_id Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_network_traffic_stat_daily_local ON CLUSTER ck_cluster
+(
+    addr_type String,
+    trans_type Int64,
+    entrance_id Int64,
+    device_id Int64,
+    direction Int64,
+    app_id Int64,
+    proto_id Int64,
+    domain_id Int64,
+    os_id Int64,
+    bs_id Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_app_statistic_local ON CLUSTER ck_cluster
+(
+    app_id Int64,
+    entrance_id Int64,
+    device_id Int64,
+    s_unq_num Int64,
+    d_unq_num Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_dest_ip_statistic_local ON CLUSTER ck_cluster
+(
+    d_ip String,
+    entrance_id Int64,
+    device_id Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_domain_statistic_local ON CLUSTER ck_cluster
+(
+    domain_id Int64,
+    entrance_id Int64,
+    device_id Int64,
+    s_unq_num Int64,
+    d_unq_num Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_protocol_statistic_local ON CLUSTER ck_cluster
+(
+    proto_id Int64,
+    entrance_id Int64,
+    device_id Int64,
+    s_unq_num Int64,
+    d_unq_num Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_source_ip_statistic_local ON CLUSTER ck_cluster
+(
+    s_ip String,
+    entrance_id Int64,
+    device_id Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_subscriber_id_statistic_local ON CLUSTER ck_cluster
+(
+    subscribe_id String,
+    entrance_id Int64,
+    device_id Int64,
+    link_num Int64,
+    c2s_pkt_num Int64,
+    s2c_pkt_num Int64,
+    c2s_byte_len Int64,
+    s2c_byte_len Int64,
+    stat_time DateTime
+)
+ENGINE = MergeTree 
+PARTITION BY toYYYYMMDD(toDate(stat_time))
+ORDER BY stat_time;
+
+
+create TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_collect_radius_log AS k18_galaxy_service.tbs_ods_ntc_collect_radius_log_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,tbs_ods_ntc_collect_radius_log_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_collect_voip_log AS k18_galaxy_service.tbs_ods_ntc_collect_voip_log_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,tbs_ods_ntc_collect_voip_log_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_conn_record_log AS k18_galaxy_service.tbs_ods_ntc_conn_record_log_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,tbs_ods_ntc_conn_record_log_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_collect_ssl_log AS k18_galaxy_service.tbs_ods_ntc_collect_ssl_log_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,tbs_ods_ntc_collect_ssl_log_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.tbs_ods_ntc_collect_http_log AS k18_galaxy_service.tbs_ods_ntc_collect_http_log_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,tbs_ods_ntc_collect_http_log_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_reject_url_statistic AS k18_galaxy_service.ntc_reject_url_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_reject_url_statistic_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_network_traffic_stat AS k18_galaxy_service.ntc_network_traffic_stat_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_network_traffic_stat_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_network_traffic_stat_hour AS k18_galaxy_service.ntc_network_traffic_stat_hour_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_network_traffic_stat_hour_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_network_traffic_stat_daily AS k18_galaxy_service.ntc_network_traffic_stat_daily_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_network_traffic_stat_daily_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_app_statistic AS k18_galaxy_service.ntc_app_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_app_statistic_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_dest_ip_statistic AS k18_galaxy_service.ntc_dest_ip_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_dest_ip_statistic_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_domain_statistic AS k18_galaxy_service.ntc_domain_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_domain_statistic_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_protocol_statistic AS k18_galaxy_service.ntc_protocol_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_protocol_statistic_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_source_ip_statistic AS k18_galaxy_service.ntc_source_ip_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_source_ip_statistic_local,rand());
+create TABLE IF NOT EXISTS k18_galaxy_service.ntc_subscriber_id_statistic AS k18_galaxy_service.ntc_subscriber_id_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_subscriber_id_statistic_local,rand());
+
+
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ip_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_http_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	url String,
+	req_hdr_file String,
+	req_hdr_key String,
+	req_body_file String,
+	req_body_key String,
+	res_hdr_file String,
+	res_hdr_key String,
+	res_body_file String,
+	res_body_key String,
+	website String,
+	isn Int64,
+	proxy_flag Int64,
+	http_seq Int64,
+	req_line String,
+	res_line String,
+	cookie String,
+	referer String,
+	user_agent String,
+	user_define_key String,
+	user_define_value String,
+	content_len String,
+	content_type String,
+	set_cookie String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_dns_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	qr Int64,
+	rd Int64,
+	ra Int64,
+	rr String,
+	qtype Int64,
+	qclass Int64,
+	opcode Int64,
+	qname String,
+	cname String,
+	dns_sub Int64,
+	cheat_type String,
+	cheat_rcode Int64,
+	cheat_strategy String,
+	cheat_rr String,
+	address String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_source_mail_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	mail_proto String,
+	mail_from String,
+	mail_to String,
+	subject String,
+	eml_key String,
+	eml_file String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_app_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	label_proto_id Int32,
+	label_proto_source Int32,
+	label_behav_id Int32,
+	label_behav_source Int32,
+	label_app_id Int32,
+	label_app_source Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ddos_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	attack_type Int64,
+	attack_start_time Int64,
+	last_attack_time Int64,
+	attack_max_pps String,
+	attack_max_bps String,
+	attack_total_pkt String,
+	attack_total_byte String,
+	is_block Int8
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ssl_log_local ON CLUSTER ck_cluster (
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	version String,
+	sni String,
+	san String,
+	cn String,
+	individual_cert_file String,
+	middle_cert_file String,
+	root_cert_file String,
+	chain_cert_file String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+
+
+
+
+
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ip_log AS k18_ods.tbs_ods_ntc_ip_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_ip_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_http_log AS k18_ods.tbs_ods_ntc_http_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_http_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_dns_log AS k18_ods.tbs_ods_ntc_dns_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_dns_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_source_mail_log AS k18_ods.tbs_ods_ntc_source_mail_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_source_mail_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_app_log AS k18_ods.tbs_ods_ntc_app_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_app_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ddos_log AS k18_ods.tbs_ods_ntc_ddos_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_ddos_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ssl_log AS k18_ods.tbs_ods_ntc_ssl_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_ssl_log_local,rand());
+
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.traffic_http_statistic_local ON CLUSTER ck_cluster (
+	web_id Int64,
+	link_num Int64,
+	c2s_pkt_num Int64,
+	s2c_pkt_num Int64,
+	c2s_byte_len Int64,
+	s2c_byte_len Int64,
+	stat_time DateTime
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(stat_time)
+ORDER BY stat_time;
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_radius_report_local ON CLUSTER ck_cluster (
+	frame_ip String,
+	account String,
+    num Int64,
+    report_time DateTime
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(report_time)
+ORDER BY report_time;
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ip_location_database_local ON CLUSTER ck_cluster (
+	ip String,
+	country String,
+	province String,
+	city String,
+	frontier String,
+	stat_time DateTime
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(stat_time)
+ORDER BY ip;
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.traffic_trans_statistic_local ON CLUSTER ck_cluster (
+ addr_type String,
+  trans_type Int64,
+  entrance_id Int64,
+  link_num Int64,
+  c2s_pkt_num Int64,
+  s2c_pkt_num Int64,
+  c2s_byte_len Int64,
+  s2c_byte_len Int64,
+  stat_time String
+) 
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(stat_time)) ORDER BY stat_time;
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.traffic_app_focus_statistic_local ON CLUSTER ck_cluster (
+ app_id Int64,
+  unique_sip_num Int64,
+  unique_dip_num Int64,
+  link_num Int64,
+  c2s_pkt_num Int64,
+  s2c_pkt_num Int64,
+  c2s_byte_len Int64,
+  s2c_byte_len Int64,
+  entrance_id Int64,
+  device_id Int64,
+  stat_time DateTime
+) 
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(stat_time)) ORDER BY stat_time;
+
+
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.traffic_http_statistic AS k18_galaxy_service.traffic_http_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,traffic_http_statistic_local,rand());
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ntc_radius_report AS k18_galaxy_service.ntc_radius_report_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ntc_radius_report_local,rand());
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.ip_location_database AS k18_galaxy_service.ip_location_database_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,ip_location_database_local,rand());
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.traffic_trans_statistic AS k18_galaxy_service.traffic_trans_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,traffic_trans_statistic_local,rand());
+CREATE TABLE IF NOT EXISTS k18_galaxy_service.traffic_app_focus_statistic AS k18_galaxy_service.traffic_app_focus_statistic_local ENGINE =Distributed(ck_cluster,k18_galaxy_service,traffic_app_focus_statistic_local,rand());
+
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_p2p_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	p2p_proto String,
+	p2p_file_id String,
+	p2p_keyword String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_pptp_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	tunnel_type Int8,
+	encrypt_mode Int8
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_av_ip_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_av_url_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_pic_ip_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ftp_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	ftp_url String,
+	ftp_content String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_l2tp_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	tunnel_type Int8,
+	encrypt_mode Int8,
+	chap_name String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_pic_url_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_voip_ip_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	duation String,
+	voip_protocol String,
+	calling_account String,
+	called_account String,
+	calling_number String,
+	called_number String,
+	from_to_store_ip String,
+	from_to_store_url String,
+	to_from_store_ip String,
+	to_from_store_url String,
+	pid String,
+	log_uri String,
+	`level` Int32,
+	fd_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_voip_account_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	duation String,
+	voip_protocol String,
+	calling_account String,
+	called_account String,
+	calling_number String,
+	called_number String,
+	from_to_store_ip String,
+	from_to_store_url String,
+	to_from_store_ip String,
+	to_from_store_url String,
+	pid String,
+	log_uri String,
+	`level` Int32,
+	fd_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_bgp_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	`type` Int8,
+	as_num String,
+	route String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_pxy_http_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	url String,
+	req_line String,
+	res_line String,
+	cookie String,
+	referer String,
+	user_agent String,
+	content_len String,
+	content_type String,
+	set_cookie String,
+	req_header String,
+	resp_header String,
+	req_body String,
+	resp_body String,
+	website String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_sample_audio_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_sample_video_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ipsec_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	ex_protocol Int8,
+	isakmp_mode Int8
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_openvpn_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	version String,
+	encrypt_mode String,
+	hmac Int8,
+	tunnel_type Int8
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ssh_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	version String,
+	host_key String,
+	host_cookie String,
+	encrypt_mode String,
+	mac String,
+	tunnel_type Int8
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_sample_pic_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_sample_voip_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	duation String,
+	voip_protocol String,
+	calling_account String,
+	called_account String,
+	calling_number String,
+	called_number String,
+	from_to_store_ip String,
+	from_to_store_url String,
+	to_from_store_ip String,
+	to_from_store_url String,
+	pid String,
+	log_uri String,
+	`level` Int32,
+	fd_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_streaming_media_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	url String,
+	protocol String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_keywords_url_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	url String,
+	website String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_porn_audio_level_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_porn_video_level_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_speaker_recognization_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+
+
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_logo_detection_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_face_recognization_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_file_digest_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	pid String,
+	url String,
+	log_uri String,
+	referer String,
+	`level` Int32,
+	fd_type Int32,
+	protocol String,
+	single_key String,
+	len Int32,
+	img_fp String,
+	user_agent String,
+	proxy_domian String,
+	acc_cnt Int32,
+	cookie String,
+	http_seq Int32,
+	proxy_flag Int32,
+	isn Int32,
+	media_type Int32
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_voip_log_local ON CLUSTER ck_cluster(
+	log_id String,
+	cfg_id Int64,
+	found_time Int64,
+	recv_time Int64,
+	trans_proto String,
+	addr_type Int64,
+	d_ip String,
+	s_ip String,
+	d_port Int64,
+	s_port Int64,
+	service Int64,
+	entrance_id Int64,
+	device_id Int64,
+	link_id Int64,
+	encap_type Int64,
+	direction Int64,
+	inner_smac String,
+	inner_dmac String,
+	stream_dir Int64,
+	cap_ip String,
+	addr_list String,
+	server_locate String,
+	client_locate String,
+	s_asn String,
+	d_asn String,
+	s_subscribe_id String,
+	d_subscribe_id String,
+	user_region String,
+	scene_file String,
+	duation String,
+	voip_protocol String,
+	calling_account String,
+	called_account String,
+	calling_number String,
+	called_number String
+)
+ENGINE=MergeTree PARTITION BY toYYYYMMDD(toDate(found_time))
+ORDER BY found_time;
+
+
+
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_pptp_log AS k18_ods.tbs_ods_ntc_pptp_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_pptp_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_p2p_log AS k18_ods.tbs_ods_ntc_p2p_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_p2p_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_av_ip_log AS k18_ods.tbs_ods_mm_av_ip_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_av_ip_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_av_url_log AS k18_ods.tbs_ods_mm_av_url_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_av_url_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_pic_ip_log AS k18_ods.tbs_ods_mm_pic_ip_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_pic_ip_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ftp_log AS k18_ods.tbs_ods_ntc_ftp_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_ftp_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_l2tp_log AS k18_ods.tbs_ods_ntc_l2tp_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_l2tp_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_pic_url_log AS k18_ods.tbs_ods_mm_pic_url_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_pic_url_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_voip_ip_log AS k18_ods.tbs_ods_mm_voip_ip_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_voip_ip_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_voip_account_log AS k18_ods.tbs_ods_mm_voip_account_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_voip_account_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_bgp_log AS k18_ods.tbs_ods_ntc_bgp_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_bgp_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_sample_audio_log AS k18_ods.tbs_ods_mm_sample_audio_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_sample_audio_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_sample_video_log AS k18_ods.tbs_ods_mm_sample_video_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_sample_video_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_pxy_http_log AS k18_ods.tbs_ods_pxy_http_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_pxy_http_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ipsec_log AS k18_ods.tbs_ods_ntc_ipsec_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_ipsec_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_openvpn_log AS k18_ods.tbs_ods_ntc_openvpn_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_openvpn_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_ssh_log AS k18_ods.tbs_ods_ntc_ssh_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_ssh_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_sample_pic_log AS k18_ods.tbs_ods_mm_sample_pic_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_sample_pic_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_sample_voip_log AS k18_ods.tbs_ods_mm_sample_voip_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_sample_voip_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_porn_audio_level_log AS k18_ods.tbs_ods_mm_porn_audio_level_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_porn_audio_level_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_porn_video_level_log AS k18_ods.tbs_ods_mm_porn_video_level_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_porn_video_level_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_speaker_recognization_log AS k18_ods.tbs_ods_mm_speaker_recognization_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_speaker_recognization_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_streaming_media_log AS k18_ods.tbs_ods_ntc_streaming_media_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_streaming_media_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_keywords_url_log AS k18_ods.tbs_ods_ntc_keywords_url_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_keywords_url_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_ntc_voip_log AS k18_ods.tbs_ods_ntc_voip_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_ntc_voip_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_face_recognization_log AS k18_ods.tbs_ods_mm_face_recognization_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_face_recognization_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_file_digest_log AS k18_ods.tbs_ods_mm_file_digest_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_file_digest_log_local,rand());
+CREATE TABLE IF NOT EXISTS k18_ods.tbs_ods_mm_logo_detection_log AS k18_ods.tbs_ods_mm_logo_detection_log_local ENGINE =Distributed(ck_cluster,k18_ods,tbs_ods_mm_logo_detection_log_local,rand());
+
+
+
diff --git a/NTC/home.md b/NTC/home.md
index 73de3e1..a2b6d68 100644
--- a/NTC/home.md
+++ b/NTC/home.md
@@ -1,4 +1,4 @@
-Galaxy NTC 集成文档
+ Galaxy NTC 集成文档
 
 ## 1.安装列表
 
@@ -39,17 +39,14 @@ Galaxy NTC 集成文档
 
 1. 登录clickhouse连接终端 dbeave 建库 
 
-  create database  k18_galaxy_service on cluster k18_cluster_big;
+  CREATE database IF NOT EXISTS k18_galaxy_service ON CLUSTER ck_cluster;
 
-  create database k18_ods  on cluster k18_cluster_log_big ;
+  CREATE database IF NOT EXISTS k18_ods ON CLUSTER ck_cluster;
 
 2.  终端工具下执行如下语句
 
-     clickhouse普通表.txt
+     clickhouse-ntc.txt
 
-     Clickhouse 小表.txt
-
-    Clickhouse 大表.txt
 
 ### 同步界面数据字典(mariadb)