fix(schema):1.删除过期汇聚表schemabr-367

2.更新测试集SQL

17 files changed, 87 insertions, 2332 deletions

diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/ck-queries-template.sql b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/ck-queries-template.sql
index 005d47fd..2db65951 100644
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/ck-queries-template.sql
+++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/ck-queries-template.sql
@@ -117,6 +117,4 @@ select common_server_ip as "Server IP" , count(1) as Sessions,sum(common_c2s_byt
 --Q59.Top5 Server IP keys with Unique Client IPs Trend (Grain 5 minute)
 SELECT toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) AS _time , common_server_ip AS server_ip, COUNT(DISTINCT(common_client_ip)) AS nums FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND common_server_ip IN ( SELECT common_server_ip FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end)  GROUP BY common_server_ip ORDER BY count(*) DESC LIMIT 5 ) GROUP BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) , server_ip ORDER BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) DESC LIMIT 100
 --Q60.JSQLParserException(V4.2)
-select round(tcp_logs / logs, 2) as "TCP Percentage", round(udp_logs / logs, 2) as "UDP Percentage", round(egress_bytes / bytes, 2) as "Egress Percentage", round(ingress_bytes / bytes, 2) as "Ingress Percentage", tcp_logs as "TCP Logs", udp_logs as "UDP Logs", logs as "Logs", egress_bytes as "Egress Bytes", ingress_bytes as "Ingress Bytes", bytes as "Bytes"from (select sum(if(common_l4_protocol in('IPv4_TCP', 'IPv6_TCP'), 1, 0)) as tcp_logs, sum(if(common_l4_protocol in('IPv4_UDP', 'IPv6_UDP'), 1, 0)) as udp_logs, sum(if(has(bitmaskToArray(common_flags), 256), common_c2s_byte_num, common_s2c_byte_num)) as egress_bytes, sum(if(has(bitmaskToArray(common_flags), 128), common_c2s_byte_num, common_s2c_byte_num)) as ingress_bytes, count(*) as logs, sum(common_c2s_byte_num + common_s2c_byte_num) as bytes from session_record as sub_connection where common_recv_time >= toUnixTimestamp(@start) and common_recv_time < toUnixTimestamp(@end))
---Q61.Concat Funtion Test sql
-select TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(common_recv_time),'PT1M','zero') as stat_time, (CASE WHEN common_action = 1 THEN 'Monitor' WHEN common_action = 2 THEN 'Intercept' WHEN common_action = 16 THEN 'Deny' WHEN common_action = 48 THEN 'Manipulation' WHEN common_action = 96 THEN 'Allow' WHEN common_action = 128 THEN 'Allow(Deprecated)' ELSE Concat(common_action) END) as type, count(*) as events from security_event where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) and common_vsys_id in (2,3) group by stat_time, common_action
\ No newline at end of file
+select round(tcp_logs / logs, 2) as "TCP Percentage", round(udp_logs / logs, 2) as "UDP Percentage", round(egress_bytes / bytes, 2) as "Egress Percentage", round(ingress_bytes / bytes, 2) as "Ingress Percentage", tcp_logs as "TCP Logs", udp_logs as "UDP Logs", logs as "Logs", egress_bytes as "Egress Bytes", ingress_bytes as "Ingress Bytes", bytes as "Bytes"from (select sum(if(common_l4_protocol in('IPv4_TCP', 'IPv6_TCP'), 1, 0)) as tcp_logs, sum(if(common_l4_protocol in('IPv4_UDP', 'IPv6_UDP'), 1, 0)) as udp_logs, sum(if(has(bitmaskToArray(common_flags), 256), common_c2s_byte_num, common_s2c_byte_num)) as egress_bytes, sum(if(has(bitmaskToArray(common_flags), 128), common_c2s_byte_num, common_s2c_byte_num)) as ingress_bytes, count(*) as logs, sum(common_c2s_byte_num + common_s2c_byte_num) as bytes from session_record as sub_connection where common_recv_time >= toUnixTimestamp(@start) and common_recv_time < toUnixTimestamp(@end))
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/druid-queries-template.sql b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/druid-queries-template.sql
index 9b7ceec6..2a2267d6 100644
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/druid-queries-template.sql
+++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/druid-queries-template.sql
@@ -1,164 +1,70 @@
---Q01.All Security Event Hits
-select policy_id, sum(hits) as hits from security_event_hits_log where __time >@start and __time <@end group by policy_id
---Q02.Security Event Hits with Policy ID 0
-select policy_id, sum(hits) as hits from security_event_hits_log where __time >@start and __time <@end and policy_id in (0)  group by policy_id
---Q03.All Security Event Hits Trend by 5min A
-select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as start_time, sum(hits) as hits from security_event_hits_log where __time >=  @start and __time <  @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') limit 10000
---Q04.Security Event Hit Time（first and last time) A
-select policy_id,TIME_FORMAT(min(__time) ,'yyyy-MM-dd HH:mm:ss')  as first_used, TIME_FORMAT(max(__time) ,'yyyy-MM-dd HH:mm:ss') as last_used from security_event_hits_log where policy_id in (0) group by policy_id
---Q05.Top 200 Security Policies
-select policy_id, sum(hits) as hits from security_event_hits_log  where __time >= @start and __time < @end  group by policy_id order by hits desc limit 200
---Q06.Top 200 Security Policies with Action
-select policy_id, action, sum(hits) as hits from security_event_hits_log  where __time >=@start and __time <@end  group by policy_id, action order by hits desc limit 200
---Q07.All Proxy Event Hits
-select policy_id, sum(hits) as hits from proxy_event_hits_log where  __time >=@start and __time <@end  group by policy_id
---Q08.Proxy Event Hits with Policy ID 0
-select policy_id, sum(hits) as hits from proxy_event_hits_log where  __time >=@start and __time <@end and policy_id=0 group by policy_id
---Q09.All Proxy Event Hits Trend by 5min A
-select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as start_time, sum(hits) as hits from proxy_event_hits_log where __time >=  @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') limit 10000
---Q10.Proxy Event Hit Time（first and last time) A
-select policy_id,TIME_FORMAT(min(__time) ,'yyyy-MM-dd HH:mm:ss')  as first_used, TIME_FORMAT(max(__time) ,'yyyy-MM-dd HH:mm:ss') as last_used from  proxy_event_hits_log where policy_id in (0) group by policy_id
---Q11.Top 200 Proxy Policies
-select policy_id, sum(hits) as hits from proxy_event_hits_log  where __time >= @start and __time < @end  group by policy_id order by hits desc limit 200
---Q12.Top 200 Proxy Policies with sub Action
-select policy_id, sub_action as action, sum(hits) as hits from proxy_event_hits_log  where __time >=@start and __time <@end  group by policy_id, sub_action order by hits desc limit 200
---Q13.Proxy Action Hits
-select sub_action as action, sum(hits) as hits from proxy_event_hits_log where  __time >=  @start and __time <  @end  group by  sub_action
---Q14.Proxy Action Hits Trend by 5min
-select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as start_time, sub_action  as action, sum(hits) as hits from proxy_event_hits_log where  __time >= @start and __time < @end  group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') , sub_action  limit 10000
---Q15.Traffic Metrics Pinning  Hits
-SELECT sum(not_pinning_num) AS sessions, 'notPinningNum' AS type FROM traffic_metrics_log WHERE __time >= @start AND __time < @end UNION ALL SELECT sum(pinning_num) AS sessions, 'pinningNum' AS type FROM traffic_metrics_log WHERE __time >= @start AND __time < @end UNION ALL SELECT sum(maybe_pinning_num) AS sessions, 'maybePinningNum' AS type FROM traffic_metrics_log WHERE __time >= @start AND __time < @end
---Q16.Traffic Metrics Pinning Trend by 5Min
-SELECT TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') AS statisticTime, sum(pinning_num) AS sessions FROM traffic_metrics_log WHERE __time >= @start AND __time < @end GROUP BY TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') LIMIT 10000
---Q17.Traffic Metrics Not Pinning Trend by 5Min
-SELECT TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') AS statisticTime, sum(not_pinning_num) AS sessions FROM traffic_metrics_log WHERE __time>= @start AND __time < @end GROUP BY TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') LIMIT 10000
---Q18.Traffic Metrics Maybe Pinning Trend by 5Min
-SELECT TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') AS statisticTime, sum(maybe_pinning_num) AS sessions FROM traffic_metrics_log WHERE __time >= @start AND __time < @end GROUP BY TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') LIMIT 10000
---Q19.Traffic Metrics Throughput Bytes IN/OUT
-select sum(total_in_bytes) as traffic_in_bytes, sum(total_out_bytes) as traffic_out_bytes  from traffic_metrics_log where  __time >=  @start and __time < @end
---Q20. Traffic Metrics Throughput Packets IN/OUT
-select sum(total_in_packets) as traffic_in_packets, sum(total_out_packets) as traffic_out_packets  from traffic_metrics_log where  __time >= @start and __time < @end
---Q21.Traffic Metrics New Sessions
-select sum(new_conn_num) as sessions  from traffic_metrics_log where  __time >= @start and __time < @end
---Q22.Traffic Metrics Bandwidth Bytes IN/OUT
-select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'traffic_in_bytes' as type, sum(total_in_bytes) as bytes from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'traffic_out_bytes' as type, sum(total_out_bytes) as bytes from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss')
---Q23.Traffic Metrics Bandwidth Packets IN/OUT
-select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'traffic_in_packets' as type, sum(total_in_packets) as packets from traffic_metrics_log where  __time >= @start and __time <  @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'traffic_out_packets' as type, sum(total_out_packets) as packets from traffic_metrics_log where __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss')
---Q24.Traffic Metrics New Sessions Trend by 5Min
-select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'new_conn_num' as type, sum(new_conn_num) as sessions from traffic_metrics_log where __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss')
---Q25.Traffic Metrics New and Live Sessions
-select  sum(new_conn_num) as new_conn_num, sum(established_conn_num) as established_conn_num from traffic_metrics_log  where __time >= @start and __time < @end
---Q26.Traffic Metrics New and Live Sessions Trend by 5Min
-select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'new_conn_num' as type, sum(new_conn_num) as sessions from traffic_metrics_log where  __time >= @start and __time <  @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'established_conn_num' as type, sum(established_conn_num) as sessions from traffic_metrics_log where   __time >= @start and __time < @end  group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss')
---Q27.Traffic Metrics Security Throughput Bytes
-select  sum(default_in_bytes+default_out_bytes) as default_bytes, sum(allow_in_bytes+allow_out_bytes) as allow_bytes, sum(deny_in_bytes+deny_out_bytes) as deny_bytes, sum(monitor_in_bytes+monitor_out_bytes) as monitor_bytes, sum(intercept_in_bytes+intercept_out_bytes) as intercept_bytes from traffic_metrics_log  where   __time >= @start and __time <  @end
---Q28.Traffic Metrics Security Throughput Packets
-select  sum(default_in_packets+default_out_packets) as default_packets, sum(allow_in_packets+allow_in_packets) as allow_packets, sum(deny_in_packets+deny_out_packets) as deny_packets, sum(monitor_in_packets+monitor_out_packets) as monitor_packets, sum(intercept_in_packets+intercept_out_packets) as intercept_packets from traffic_metrics_log  where   __time >= @start and __time < @end
---Q29.Traffic Metrics Security Throughput Sessions
-select sum(default_conn_num) as default_sessions, sum(allow_conn_num) as allow_sessions, sum(deny_conn_num) as deny_sessions, sum(monitor_conn_num) as monitor_sessions, sum(intercept_conn_num) as intercept_sessions from traffic_metrics_log  where   __time >= @start and __time < @end
---Q30.Traffic Metrics Security Bandwidth Bytes by 5Min
-select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'default_bytes' as type, sum(default_in_bytes+default_out_bytes) as bytes from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'allow_bytes' as type,  sum(allow_in_bytes+allow_out_bytes) as bytes from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'deny_bytes' as type,  sum(deny_in_bytes+deny_out_bytes) as bytes from traffic_metrics_log where  __time >=  @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'monitor_bytes' as type,  sum(monitor_in_bytes+monitor_out_bytes) as bytes from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'intercept_bytes' as type,  sum(intercept_in_bytes+intercept_out_bytes) as bytes from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss')
---Q31.Traffic Metrics Security Bandwidth Packets by 5Min
-select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'default_packets' as type, sum(default_in_packets+default_out_packets) as packets from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'allow_packets' as type, sum(allow_in_packets+allow_out_packets) as packets from traffic_metrics_log where  __time >=  @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'deny_packets' as type, sum(deny_in_packets+deny_out_packets) as packets from traffic_metrics_log where  __time >=  @start and __time <  @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'monitor_packets' as type, sum(monitor_in_packets+monitor_out_packets) as packets from traffic_metrics_log where  __time >=  @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'intercept_packets' as type, sum(intercept_in_packets+intercept_out_packets) as packets from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss')
---Q32.Traffic Metrics Security Sessions Trend by 5Min
-select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'default_conn_num' as type, sum(default_conn_num) as sessions from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'allow_conn_num' as type, sum(allow_conn_num) as sessions from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'deny_conn_num' as type, sum(deny_conn_num) as sessions from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'monitor_conn_num' as type, sum(monitor_conn_num) as sessions from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'intercept_conn_num' as type, sum(intercept_conn_num) as sessions from traffic_metrics_log where  __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss')
---Q33.Top 100 Client IP by Sessions
-select source as client_ip, sum(session_num) as sessions, sum(c2s_byte_num) as sent_bytes, sum(s2c_byte_num) as received_bytes, sum(c2s_byte_num + s2c_byte_num) as bytes,  sum(c2s_pkt_num) as sent_packets ,sum(s2c_pkt_num) as received_packets, sum(c2s_pkt_num+s2c_pkt_num) as packets from top_client_ip_log where  __time >= @start and __time < @end and order_by='sessions' group by source order by sessions desc limit 100
---Q34.Top 100 Server IP by Sessions
-select destination as server_ip, sum(session_num) as sessions, sum(c2s_byte_num) as sent_bytes, sum(s2c_byte_num) as received_bytes, sum(c2s_byte_num + s2c_byte_num) as bytes,  sum(c2s_pkt_num) as sent_packets ,sum(s2c_pkt_num) as received_packets, sum(c2s_pkt_num+s2c_pkt_num) as packets from top_server_ip_log where  __time >= @start and __time < @end and order_by='sessions' group by destination order by sessions desc limit 100
---Q35.Top 100 Internal IP by Sessions
-select source as internal_ip, sum(session_num) as sessions, sum(c2s_byte_num) as sent_bytes, sum(s2c_byte_num) as received_bytes, sum(c2s_byte_num + s2c_byte_num) as bytes,  sum(c2s_pkt_num) as sent_packets ,sum(s2c_pkt_num) as received_packets, sum(c2s_pkt_num+s2c_pkt_num) as packets from top_internal_host_log  where  __time >= @start and __time < @end and order_by='sessions' group by source order by sessions desc limit 100
---Q36.Top 100 External IP by Sessions
-select destination as external_ip, sum(session_num) as sessions, sum(c2s_byte_num) as sent_bytes, sum(s2c_byte_num) as received_bytes, sum(c2s_byte_num + s2c_byte_num) as bytes,  sum(c2s_pkt_num) as sent_packets ,sum(s2c_pkt_num) as received_packets, sum(c2s_pkt_num+s2c_pkt_num) as packets from top_external_host_log  where  __time >= @start and __time < @end and order_by='sessions' group by destination order by sessions desc limit 100
---Q37.Top 100 Domain by Bytes
-select domain, sum(session_num) as sessions, sum(c2s_byte_num) as sent_bytes, sum(s2c_byte_num) as received_bytes, sum(c2s_byte_num + s2c_byte_num) as bytes,  sum(c2s_pkt_num) as sent_packets ,sum(s2c_pkt_num) as received_packets, sum(c2s_pkt_num+s2c_pkt_num) as packets from top_website_domain_log where  __time >= @start and __time < @end  and order_by='bytes' group by domain order by bytes desc limit 100
---Q38.Top 100 Subscriber ID by Sessions
-select subscriber_id, sum(session_num) as sessions, sum(c2s_byte_num) as sent_bytes, sum(s2c_byte_num) as received_bytes, sum(c2s_byte_num + s2c_byte_num) as bytes,  sum(c2s_pkt_num) as sent_packets ,sum(s2c_pkt_num) as received_packets, sum(c2s_pkt_num+s2c_pkt_num) as packets from top_user_log where  __time >= @start and __time < @end  and order_by='sessions' group by subscriber_id order by sessions desc limit 100
---Q39.Top 100 Hit URLS by hits
-select url,sum(session_num) as hits  from top_urls_log where __time >= @start and __time < @end  group by url order by hits desc limit 100
---Q40.Proxy Event Unique ISP
-SELECT policy_id, APPROX_COUNT_DISTINCT_DS_HLL(isp) as num  FROM proxy_event_hits_log where  __time >= @start and __time < @end group by policy_id
---Q41.Traffic Composition Metrics
-SELECT APPROX_COUNT_DISTINCT_DS_HLL(ip_object) AS uniq_client_ip, SUM(one_sided_connections) AS one_sided_connections, SUM(fragmentation_packets) AS fragmentation_packets, SUM(sequence_gap_loss) AS sequence_gap_loss_bytes, SUM(s2c_byte_num+c2s_byte_num) AS summaryTotalBytes, SUM(s2c_pkt_num+c2s_pkt_num) AS summaryTotalPackets, SUM(sessions) AS summarySessions FROM traffic_summary_log WHERE __time >= @start AND __time < @end  LIMIT 1
---Q42.Traffic Composition Throughput
-(SELECT SUM(c2s_byte_num + s2c_byte_num) as total_bytes, SUM(sessions) as total_sessions, (SUM(c2s_byte_num + s2c_byte_num) * 8)/((TIMESTAMP_TO_MILLIS( @end )-TIMESTAMP_TO_MILLIS( @start ))/1000) AS data_rate FROM traffic_protocol_stat_log WHERE __time >=  @start AND __time <  @end AND protocol_id = 'ETHERNET' LIMIT 1) UNION ALL ( SELECT SUM(sessions), 0, 0 FROM traffic_protocol_stat_log WHERE __time >=  @start AND __time <  @end AND protocol_id = 'ETHERNET' GROUP BY __time ORDER BY __time DESC LIMIT 1 )
---Q43.Traffic Composition Protocol Tree
-SELECT protocol_id, SUM(sessions) as sessions,SUM(c2s_byte_num) as c2s_byte_num, SUM(c2s_pkt_num) as c2s_pkt_num, SUM(s2c_byte_num) as s2c_byte_num, SUM(s2c_pkt_num) as s2c_pkt_num FROM traffic_protocol_stat_log WHERE __time >=  @start AND __time <  @end GROUP BY protocol_id
---Q44.System Quota
-SELECT log_type, SUM(used_size) as used_size, SUM(max_size) * 7/10 as max_size, TIME_FORMAT(LATEST(last_storage) * 1000,'YYYY-MM-dd') as first_storage FROM ( SELECT log_type, LATEST(used_size) as used_size, LATEST(max_size) as max_size, LATEST(last_storage) as last_storage FROM sys_storage_log WHERE __time >= CURRENT_TIMESTAMP - INTERVAL '1' HOUR AND data_center != '' GROUP BY data_center,log_type ) GROUP BY log_type
---Q45.System Quota Daily Trend
-select TIME_FORMAT(__time,'YYYY-MM-dd') as stat_time,log_type as type, sum(aggregate_size) as used_size from sys_storage_log where __time >= @start and __time < @end group by TIME_FORMAT(__time,'YYYY-MM-dd'), log_type
---Q46.Traffic Statistics(Metrics01)
-select sum(total_hit_sessions) as total_hit_sessions, sum(total_bytes_transferred) as total_bytes_transferred, sum(total_packets_transferred) as total_packets_transferred, sum(total_new_sessions) as total_new_sessions , sum(total_close_sessions) as total_close_sessions, sum(average_new_sessions_per_second) as average_new_sessions_per_second , sum(average_bytes_per_second) as average_bytes_per_second , sum(average_packets_per_second) as average_packets_per_second , COUNT(DISTINCT(device_id)) as device_num, sum(live_sessions) as average_live_sessions from ( select device_id, sum(intercept_conn_num + monitor_conn_num + deny_conn_num + allow_conn_num) as total_hit_sessions, sum(total_in_bytes + total_out_bytes) as total_bytes_transferred, sum(total_in_packets + total_out_packets) as total_packets_transferred, sum(new_conn_num) as total_new_sessions, sum(close_conn_num) as total_close_sessions, avg(nullif(new_conn_num, 0))/ 5 as average_new_sessions_per_second, avg(nullif(total_in_bytes + total_out_bytes, 0))* 8 / 5 as average_bytes_per_second, avg(nullif(total_in_packets + total_out_packets, 0))/ 5 as average_packets_per_second, avg(nullif(established_conn_num, 0)) as live_sessions from traffic_metrics_log where __time >= @start and __time < @end group by device_id)
---Q47.Traffic Live Chart unknown App bytes
-SELECT SUM(c2s_byte_num + s2c_byte_num) as unknown_app_bytes FROM traffic_protocol_stat_log WHERE __time >= @start and __time < @end AND app_name = 'unknown' LIMIT 1
---Q48.All Security Rule Hits
+--Q01.All Security Rule Hits
 select rule_id as rule_id,sum(hit_count) as hits,sum(in_bytes + out_bytes) as bytes from security_rule_hits where __time >@start and __time <@end group by rule_id
---Q49.Security Rule Hits with Rule ID 0
+--Q02.Security Rule Hits with Rule ID 0
 select rule_id as rule_id,sum(hit_count) as hits from security_rule_hits where __time >@start and __time <@end and rule_id in (0)  group by rule_id
---Q50.All Security Rule Hits Trend by 5min A
+--Q03.All Security Rule Hits Trend by 5min A
 select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, sum(hit_count) as hits from security_rule_hits where __time >=  @start and __time <  @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') limit 10000
---Q51.Security Rule Hit Time（first and last time) A
+--Q04.Security Rule Hit Time（first and last time) A
 select rule_id,TIME_FORMAT(min(__time) ,'yyyy-MM-dd HH:mm:ss')  as first_used, TIME_FORMAT(max(__time) ,'yyyy-MM-dd HH:mm:ss') as last_used from security_rule_hits where rule_id in (0) group by rule_id
---Q52.Top 200 Security Rules with Action
+--Q05.Top 200 Security Rules with Action
 select rule_id, action, sum(hit_count) as hits from security_rule_hits  where __time >= @start and __time < @end  group by rule_id, action order by hits desc limit 200
---Q53.All Proxy Rule Hits
+--Q06.All Proxy Rule Hits
 select rule_id as rule_id, sum(hit_count) as hits from proxy_rule_hits where  __time >=@start and __time <@end  group by rule_id
---Q54.Proxy Rule Hits with Rule ID 0
+--Q07.Proxy Rule Hits with Rule ID 0
 select rule_id, sum(hit_count) as hits from proxy_rule_hits where  __time >=@start and __time <@end and rule_id=0 group by rule_id
---Q55.All Proxy Rule Hits Trend by 5min A
+--Q08.All Proxy Rule Hits Trend by 5min A
 select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, sum(hit_count) as hits from proxy_rule_hits where __time >=  @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') limit 10000
---Q56.Proxy Rule Hit Time（first and last time) A
+--Q09.Proxy Rule Hit Time（first and last time) A
 select rule_id as rule_id,TIME_FORMAT(min(__time) ,'yyyy-MM-dd HH:mm:ss')  as first_used, TIME_FORMAT(max(__time) ,'yyyy-MM-dd HH:mm:ss') as last_used from  proxy_rule_hits where rule_id in (0) group by rule_id
---Q57.Top 200 Proxy Rules
+--Q10.Top 200 Proxy Rules
 select rule_id, sum(hit_count) as hits from proxy_rule_hits  where __time >= @start and __time < @end  group by rule_id order by hits desc limit 200
---Q58.Top 200 Proxy Rules with Action
+--Q11.Top 200 Proxy Rules with Action
 select rule_id, action, sum(hit_count) as hits from proxy_rule_hits  where __time >=@start and __time <@end  group by rule_id, action order by hits desc limit 200
---Q59.Proxy Action Hits
+--Q12.Proxy Action Hits
 select action as action, sum(hit_count) as hits from proxy_rule_hits where  __time >=  @start and __time <  @end  group by action
---Q60.Proxy Action Hits Trend by 5min
+--Q13.Proxy Action Hits Trend by 5min
 select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, action as action, sum(hit_count) as hits from proxy_rule_hits where  __time >= @start and __time < @end  group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') , action  limit 10000
---Q61.Traffic Metric[Bits/s | Bytes/s | Packets/s | Sessions/s | Active Sessions]
+--Q14.Traffic Metric[Bits/s | Bytes/s | Packets/s | Sessions/s | Active Sessions]
 SELECT sum(sum_in_bytes) * 8 / 15 AS avg_in_bits_per_sec, sum(sum_out_bytes) * 8 / 15 AS avg_out_bits_per_sec, sum(sum_in_bytes + sum_out_bytes) * 8 / 15 AS avg_bits_per_sec, sum(sum_in_bytes) / 15 AS avg_in_bytes_per_sec, sum(sum_out_bytes) / 15 AS avg_out_bytes_per_sec, sum(sum_in_bytes + sum_out_bytes) / 15 AS avg_bytes_per_sec, sum(sum_in_pkts) / 15 AS avg_in_pkts_per_sec, sum(sum_out_pkts) / 15 AS avg_out_pkts_per_sec, sum(sum_in_pkts + sum_out_pkts) / 15 AS avg_pkts_per_sec, sum(sum_sessions) / 15 AS avg_sessions_per_sec, sum(max_active_sessions) AS active_sessions FROM ( SELECT device_id, vsys_id, sum(in_bytes) AS sum_in_bytes, sum(out_bytes) AS sum_out_bytes, sum(in_pkts) AS sum_in_pkts, sum(out_pkts) AS sum_out_pkts, sum(sessions) AS sum_sessions, max(active_sessions) AS max_active_sessions FROM traffic_general_stat WHERE __time >= @start AND __time < @end GROUP BY device_id, vsys_id )
---Q62.Traffic Metrics Bandwidth Bits IN/OUT
+--Q15.Traffic Metrics Bandwidth Bits IN/OUT
 SELECT stat_time AS stat_time, avg(sum_in_bytes) * 8 / 15 AS avg_in_bits_per_sec, avg(sum_out_bytes) * 8 / 15 AS avg_out_bits_per_sec, avg(sum_bytes) * 8 / 15 AS avg_bits_per_sec, max(sum_in_bytes) * 8 / 15 AS max_in_bits_per_sec, max(sum_out_bytes) * 8 / 15 AS max_out_bits_per_sec, max(sum_bytes) * 8 / 15 AS max_bits_per_sec, min(sum_in_bytes) * 8 / 15 AS min_in_bits_per_sec, min(sum_out_bytes) * 8 / 15 AS min_out_bits_per_sec, min(sum_bytes) * 8 / 15 AS min_bits_per_sec FROM ( SELECT TIME_FORMAT(time_floor(__time, 'PT30S'), 'yyyy-MM-dd HH:mm:ss') AS stat_time, sum(in_bytes) AS sum_in_bytes, sum(out_bytes) AS sum_out_bytes, sum(in_bytes + out_bytes) AS sum_bytes FROM traffic_general_stat WHERE __time >= @start AND __time <@end GROUP BY TIME_FORMAT(time_floor(__time, 'PT30S'), 'yyyy-MM-dd HH:mm:ss') ) GROUP BY stat_time ORDER BY stat_time ASC LIMIT 10000
---Q63.Traffic Metrics Bandwidth Bytes IN/OUT
+--Q16.Traffic Metrics Bandwidth Bytes IN/OUT
 SELECT stat_time AS stat_time, avg(sum_in_bytes) / 15 AS avg_in_bits_per_sec,  avg(sum_out_bytes) / 15 AS avg_out_bits_per_sec,  avg(sum_bytes) / 15 AS avg_bits_per_sec, max(sum_in_bytes)  / 15 AS max_in_bits_per_sec, max(sum_out_bytes) / 15 AS max_out_bits_per_sec, max(sum_bytes) / 15 AS max_bits_per_sec, min(sum_in_bytes) / 15 AS min_in_bits_per_sec, min(sum_out_bytes)  / 15 AS min_out_bits_per_sec, min(sum_bytes)  / 15 AS min_bits_per_sec FROM ( SELECT TIME_FORMAT(time_floor(__time, 'PT30S'), 'yyyy-MM-dd HH:mm:ss') AS stat_time, sum(in_bytes) AS sum_in_bytes, sum(out_bytes) AS sum_out_bytes, sum(in_bytes + out_bytes) AS sum_bytes FROM traffic_general_stat WHERE __time >= @start AND __time <@end GROUP BY TIME_FORMAT(time_floor(__time, 'PT30S'), 'yyyy-MM-dd HH:mm:ss') ) GROUP BY stat_time ORDER BY stat_time ASC LIMIT 10000
---Q64.Traffic Metrics Bandwidth Packets IN/OUT
+--Q17.Traffic Metrics Bandwidth Packets IN/OUT
 SELECT stat_time AS stat_time, avg(sum_in_pkts) / 15 AS avg_in_pkts_per_sec , avg(sum_out_pkts) / 15 AS avg_out_pkts_per_sec , avg(sum_pkts) / 15 AS avg_pkts_per_sec , max(sum_in_pkts) / 15 AS max_in_pkts_per_sec , max(sum_out_pkts) / 15 AS max_out_pkts_per_sec , max(sum_pkts) / 15 AS max_pkts_per_sec , min(sum_in_pkts) / 15 AS min_in_pkts_per_sec , min(sum_out_pkts) / 15 AS min_out_pkts_per_sec , min(sum_pkts) / 15 AS min_pkts_per_sec FROM ( SELECT TIME_FORMAT(time_floor(__time, 'PT30S'), 'yyyy-MM-dd HH:mm:ss') AS stat_time , sum(in_pkts) AS sum_in_pkts, sum(out_pkts) AS sum_out_pkts , sum(in_pkts + out_pkts) AS sum_pkts FROM traffic_general_stat WHERE __time >= @start AND __time <@end GROUP BY TIME_FORMAT(time_floor(__time, 'PT30S'), 'yyyy-MM-dd HH:mm:ss') ) GROUP BY stat_time ORDER BY stat_time ASC LIMIT 10000
---Q65.Traffic Metrics New Sessions Trend by 5Min
+--Q18.Traffic Metrics New Sessions Trend by 5Min
 SELECT stat_time AS stat_time, avg(sum_sessions) / 15 AS avg_sessions_per_sec , max(sum_sessions) / 15 AS max_sessions_per_sec , min(sum_sessions) / 15 AS min_sessions_per_sec FROM ( SELECT TIME_FORMAT(time_floor(__time, 'PT5M'), 'yyyy-MM-dd HH:mm:ss') AS stat_time , sum(sessions) AS sum_sessions FROM traffic_general_stat WHERE __time >= @start AND __time <@end GROUP BY TIME_FORMAT(time_floor(__time, 'PT5M'), 'yyyy-MM-dd HH:mm:ss') ) GROUP BY stat_time ORDER BY stat_time ASC LIMIT 10000
---Q66.Traffic Metrics Active Sessions Trend by 5Min
+--Q19.Traffic Metrics Active Sessions Trend by 5Min
 SELECT stat_time AS stat_time, avg(sum_active_sessions) / 15 AS avg_active_sessions , max(sum_active_sessions) / 15 AS max_active_sessions , min(sum_active_sessions) / 15 AS min_active_sessions FROM ( SELECT stat_time, sum(max_active_sessions) AS sum_active_sessions FROM ( SELECT TIME_FORMAT(time_floor(__time, 'PT5M'), 'yyyy-MM-dd HH:mm:ss') AS stat_time , device_id, vsys_id, max(active_sessions) AS max_active_sessions FROM traffic_general_stat WHERE __time >= @start AND __time <@end GROUP BY TIME_FORMAT(time_floor(__time, 'PT5M'), 'yyyy-MM-dd HH:mm:ss'), device_id, vsys_id ) GROUP BY stat_time ) GROUP BY stat_time ORDER BY stat_time ASC LIMIT 10000
---Q67.Shaping Profiles Metrics
+--Q20.Shaping Profiles Metrics
 SELECT profile_id, sum(in_bytes + out_bytes) AS bytes , sum(in_pkts + out_pkts) AS packets , sum(in_drop_pkts + out_drop_pkts) AS drops , max(in_max_latency_us + out_max_latency_us) AS max_latency_us , avg(in_queue_len + out_queue_len) AS avg_q , max(in_queue_len + out_queue_len) AS max_q FROM traffic_shaping_rule_hits WHERE __time >= @start AND __time <@end GROUP BY profile_id
---Q68.Rule Summary Metrics
+--Q21.Rule Summary Metrics
 SELECT rule_id, TIME_FORMAT(min(__time) ,'yyyy-MM-dd HH:mm:ss')  as first_used, TIME_FORMAT(max(__time) ,'yyyy-MM-dd HH:mm:ss') as last_used, sum(in_bytes + out_bytes) AS total_bytes FROM traffic_shaping_rule_hits WHERE __time >= @start AND __time <@end GROUP BY rule_id
---Q69.Profile Summary Metrics
+--Q22.Profile Summary Metrics
 SELECT profile_id, TIME_FORMAT(min(__time) ,'yyyy-MM-dd HH:mm:ss')  as first_used, TIME_FORMAT(max(__time) ,'yyyy-MM-dd HH:mm:ss') as last_used, sum(in_drop_pkts + out_drop_pkts) AS drops FROM traffic_shaping_rule_hits WHERE __time >= @start AND __time <@end GROUP BY profile_id
---Q70.Shaping Rule/Profile Throughput Trend by 5Min
+--Q23.Shaping Rule/Profile Throughput Trend by 5Min
 SELECT TIME_FORMAT(time_floor(__time, 'PT5M'), 'yyyy-MM-dd HH:mm:ss') AS stat_time , sum(in_bytes) AS in_bytes, sum(out_bytes) AS out_bytes FROM traffic_shaping_rule_hits WHERE __time >= @start AND __time <@end GROUP BY TIME_FORMAT(time_floor(__time, 'PT5M'), 'yyyy-MM-dd HH:mm:ss') ORDER BY stat_time ASC LIMIT 10000
---Q71.Service Chaining Rule Metrics
+--Q24.Service Chaining Rule Metrics
 SELECT rule_id, sum(sent_bytes) AS sent_bytes, sum(recv_bytes) AS received_bytes , sum(sent_pkts) AS sent_packets, sum(recv_pkts) AS received_packets FROM service_chaining_rule_hits WHERE __time >= @start AND __time <@end GROUP BY rule_id
---Q72.Service Function Forwarder Metrics
+--Q25.Service Function Forwarder Metrics
 SELECT sff_profile_id, sum(sent_bytes) AS sent_bytes, sum(recv_bytes) AS received_bytes , sum(sent_pkts) AS sent_packets, sum(recv_pkts) AS received_packets FROM service_chaining_rule_hits WHERE __time >= @start AND __time <@end GROUP BY sff_profile_id
---Q73.Service Function Profile Metrics
+--Q26.Service Function Profile Metrics
 SELECT sf_profile_id, sum(sent_bytes) AS sent_bytes, sum(recv_bytes) AS received_bytes , sum(sent_pkts) AS sent_packets, sum(recv_pkts) AS received_packets FROM service_chaining_rule_hits WHERE __time >= @start AND __time <@end GROUP BY sf_profile_id
---Q74.Service Function Profile Status
+--Q27.Service Function Profile Status
 SELECT sf_profile_id, sf_status,CASE WHEN last_active_time = 0 THEN '' ELSE TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * (last_active_time)),'YYYY-MM-dd HH:mm:ss') END AS last_active_time,CASE  WHEN last_inactive_time = 0 THEN '' ELSE TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * (last_inactive_time)),'YYYY-MM-dd HH:mm:ss') END AS last_inactive_time FROM ( SELECT sf_profile_id, LATEST(sf_status) AS sf_status,MAX(CASE WHEN sf_status = 1 THEN TIMESTAMP_TO_MILLIS(TIME_PARSE(__time))/1000 ELSE 0 END) AS last_active_time,MAX(CASE WHEN sf_status = 0 THEN TIMESTAMP_TO_MILLIS(TIME_PARSE(__time))/1000 ELSE 0 END) AS last_inactive_time FROM service_function_status WHERE __time >= @start AND __time <@end GROUP BY sf_profile_id)
---Q75.Top Applications
+--Q28.Top Applications
 SELECT app_name,sum(sessions) AS sessions,sum(in_bytes) AS in_bytes,sum(out_bytes) AS out_bytes,sum(in_bytes + out_bytes) AS bytes,sum(in_pkts) AS in_packets,sum(out_pkts) AS out_packets,sum(in_pkts + out_pkts) AS packets FROM application_protocol_stat WHERE __time >= @start AND __time <@end AND app_name IS NOT NULL GROUP BY app_name ORDER BY bytes DESC LIMIT 10
---Q76.Top Client IPs
+--Q29.Top Client IPs
 SELECT client_ip AS client_ip,sum(sessions) AS sessions,sum(in_bytes) AS in_bytes,sum(out_bytes) AS out_bytes,sum(in_bytes + out_bytes) AS bytes,sum(in_pkts) AS in_packets,sum(out_pkts) AS out_packets,sum(in_pkts + out_pkts) AS packets FROM top_client_ips WHERE __time >= @start AND __time <@end AND metric = 'bytes' GROUP BY client_ip ORDER BY bytes DESC LIMIT 10
---Q77.Top Server IPs
+--Q30.Top Server IPs
 SELECT server_ip AS server_ip,sum(sessions) AS sessions,sum(in_bytes) AS in_bytes,sum(out_bytes) AS out_bytes,sum(in_bytes + out_bytes) AS bytes,sum(in_pkts) AS in_packets,sum(out_pkts) AS out_packets,sum(in_pkts + out_pkts) AS packets FROM top_server_ips WHERE __time >= @start AND __time <@end AND metric = 'bytes' GROUP BY server_ip ORDER BY bytes DESC LIMIT 10
---Q78.Top External IPs
+--Q31.Top External IPs
 SELECT external_ip AS external_ip,sum(sessions) AS sessions,sum(in_bytes) AS in_bytes,sum(out_bytes) AS out_bytes,sum(in_bytes + out_bytes) AS bytes,sum(in_pkts) AS in_packets,sum(out_pkts) AS out_packets,sum(in_pkts + out_pkts) AS packets FROM top_external_ips WHERE __time >= @start AND __time <@end AND metric = 'bytes' GROUP BY external_ip ORDER BY bytes DESC LIMIT 10
---Q79.Top Internal IPs
+--Q32.Top Internal IPs
 SELECT internal_ip AS internal_ip,sum(sessions) AS sessions,sum(in_bytes) AS in_bytes,sum(out_bytes) AS out_bytes,sum(in_bytes + out_bytes) AS bytes,sum(in_pkts) AS in_packets,sum(out_pkts) AS out_packets,sum(in_pkts + out_pkts) AS packets FROM top_internal_ips WHERE __time >= @start AND __time <@end AND metric = 'bytes' GROUP BY internal_ip ORDER BY bytes DESC LIMIT 10
---Q80.Top Server Domains
+--Q33.Top Server Domains
 SELECT domain,sum(sessions) AS sessions,sum(in_bytes) AS in_bytes,sum(out_bytes) AS out_bytes,sum(in_bytes + out_bytes) AS bytes,sum(in_pkts) AS in_packets,sum(out_pkts) AS out_packets,sum(in_pkts + out_pkts) AS packets FROM top_server_domains WHERE __time >= @start AND __time <@end AND metric = 'bytes' GROUP BY domain ORDER BY bytes DESC LIMIT 10
---Q81.Top Server FQDNs
+--Q34.Top Server FQDNs
 SELECT fqdn,sum(sessions) AS sessions,sum(in_bytes) AS in_bytes,sum(out_bytes) AS out_bytes,sum(in_bytes + out_bytes) AS bytes,sum(in_pkts) AS in_packets,sum(out_pkts) AS out_packets,sum(in_pkts + out_pkts) AS packets FROM top_server_fqdns WHERE __time >= @start AND __time <@end AND metric = 'bytes' GROUP BY fqdn ORDER BY bytes DESC LIMIT 10
---Q82.Top Subscribers
+--Q35.Top Subscribers
 SELECT subscriber_id,sum(sessions) AS sessions,sum(in_bytes) AS in_bytes,sum(out_bytes) AS out_bytes,sum(in_bytes + out_bytes) AS bytes,sum(in_pkts) AS in_packets,sum(out_pkts) AS out_packets,sum(in_pkts + out_pkts) AS packets FROM top_subscribers WHERE __time >= @start AND __time <@end AND metric = 'bytes' GROUP BY subscriber_id ORDER BY bytes DESC LIMIT 10
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/engine-queries-template.sql b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/engine-queries-template.sql
index 02b909bc..14cd24c9 100644
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/engine-queries-template.sql
+++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/engine-queries-template.sql
@@ -6,135 +6,101 @@ select FROM_UNIXTIME(common_recv_time) as common_recv_time from session_record w
 select count(1) from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end)
 --Q04.count(*)
 select count(*) from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end)
---Q05.UDF APPROX_COUNT_DISTINCT_DS_HLL
-SELECT policy_id, APPROX_COUNT_DISTINCT_DS_HLL(isp) as num  FROM proxy_event_hits_log where  __time >= @start and __time < @end and policy_id=0 group by policy_id
---Q06.UDF TIME_FLOOR_WITH_FILL
+--Q05.UDF TIME_FLOOR_WITH_FILL
 select TIME_FLOOR_WITH_FILL(common_recv_time,'PT5M','previous') as stat_time from session_record where  common_recv_time > toDateTime(@start) and common_recv_time < toDateTime(@end)  group by stat_time
---Q07.UDF GEO IP
+--Q06.UDF GEO IP
 select IP_TO_GEO(common_client_ip) as geo,IP_TO_CITY(common_server_ip) as city,IP_TO_COUNTRY(common_server_ip) as country from session_record limit 10
---Q08.Special characters
+--Q07.Special characters
 select * from session_record where (common_protocol_label ='/$' or common_client_ip like'%') limit 10
---Q09.Federation Query
+--Q08.Federation Query
 select * from (select FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(common_recv_time,'PT5M','zero')) as stat_time from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) group by stat_time order by stat_time asc)
---Q10.Closed session Record Logs
+--Q09.Closed session Record Logs
 select * from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end)  AND @common_filter order by common_recv_time desc limit 20
---Q11.Interim Session Record Logs
+--Q10.Interim Session Record Logs
 select * from interim_session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end)  AND @common_filter order by common_recv_time desc limit 20
---Q12.Transaction  Record Logs
+--Q11.Transaction  Record Logs
 select * from transaction_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end)  order by common_recv_time desc limit 20
---Q13.Security Event Logs
+--Q12.Security Event Logs
 select * from security_event where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) AND @common_filter order by common_recv_time desc limit 0,20
---Q14.Proxy Event Logs
+--Q13.Proxy Event Logs
 select * from proxy_event where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) order by common_recv_time desc limit 0,20
---Q15.Radius Record Logs
+--Q14.Radius Record Logs
 select * from radius_record where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) order by common_recv_time desc limit 0,20
---Q16.GTPC Record Logs
+--Q15.GTPC Record Logs
 select * from gtpc_record where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) order by common_recv_time desc limit 0,20
---Q17.Closed session record with fields
+--Q16.Closed session record with fields
 select toDateTime(common_recv_time) AS common_recv_time, common_log_id, common_subscriber_id, common_imei, common_imsi, common_phone_number, common_client_ip, common_internal_ip, common_client_port, common_l4_protocol, common_address_type, common_server_ip, common_server_port, common_external_ip, common_sled_ip, common_client_location, common_client_asn, common_server_location, common_server_asn, common_sessions, common_c2s_pkt_num, common_s2c_pkt_num, common_c2s_byte_num, common_s2c_byte_num, common_schema_type, common_device_id, common_device_group, common_app_behavior, common_app_label, common_tunnels, common_protocol_label, common_userdefine_app_name, common_l7_protocol, common_service_category, toDateTime(common_start_time) AS common_start_time, toDateTime(common_end_time) AS common_end_time, common_establish_latency_ms, common_con_duration_ms, common_stream_dir, common_stream_trace_id, common_c2s_ipfrag_num, common_s2c_ipfrag_num, common_c2s_tcp_lostlen, common_s2c_tcp_lostlen, common_c2s_tcp_unorder_num, common_s2c_tcp_unorder_num, common_c2s_pkt_retrans, common_s2c_pkt_retrans, common_c2s_byte_retrans, common_s2c_byte_retrans, common_tcp_client_isn, common_tcp_server_isn, toDateTime(common_processing_time) AS common_processing_time, toDateTime(common_ingestion_time) AS common_ingestion_time, http_url, http_host, common_server_domain, http_request_line, http_response_line, http_request_content_length, http_request_content_type, http_response_content_length, http_response_content_type, http_request_body, http_response_body, http_cookie, http_referer, http_user_agent, http_set_cookie, http_version, http_response_latency_ms, http_session_duration_ms, http_action_file_size, mail_protocol_type, mail_account, mail_from_cmd, mail_to_cmd, mail_from, mail_to, mail_cc, mail_bcc, mail_subject, mail_attachment_name, mail_eml_file, dns_message_id, dns_qr, dns_opcode, dns_aa, dns_tc, dns_rd, dns_ra, dns_rcode, dns_qdcount, dns_ancount, dns_nscount, dns_arcount, dns_qname, dns_qtype, dns_qclass, dns_sub, dns_response_latency_ms, ssl_sni, ssl_cn, ssl_pinningst, ssl_intercept_state, ssl_server_side_latency, ssl_client_side_latency, ssl_server_side_version, ssl_client_side_version, ssl_cert_verify, ssl_error, ssl_con_latency_ms, ssl_ja3_hash, ssl_cert_issuer, ssl_cert_subject, quic_version, quic_sni, quic_user_agent, ftp_account, ftp_url, ftp_content, ftp_link_type, app_extra_info, sip_call_id, sip_originator_description, sip_responder_description, sip_user_agent, sip_server, sip_originator_sdp_connect_ip, sip_originator_sdp_media_port, sip_originator_sdp_media_type, sip_originator_sdp_content, sip_responder_sdp_connect_ip, sip_responder_sdp_media_port, sip_responder_sdp_media_type, sip_responder_sdp_content, sip_duration_s, sip_bye, rtp_payload_type_c2s, rtp_payload_type_s2c, rtp_pcap_path, ssh_version, ssh_auth_success, ssh_client_version, ssh_server_version, ssh_cipher_alg, ssh_mac_alg, ssh_compression_alg, ssh_kex_alg, ssh_host_key_alg, ssh_host_key, ssh_hassh, stratum_cryptocurrency, stratum_mining_pools, stratum_mining_program from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) limit 20
---Q18.Interim session record with fields
+--Q17.Interim session record with fields
 SELECT toDateTime(common_recv_time) AS common_recv_time, common_log_id, common_subscriber_id, common_imei, common_imsi, common_phone_number, common_client_ip, common_internal_ip, common_client_port, common_l4_protocol, common_address_type, common_server_ip, common_server_port, common_external_ip, common_sled_ip, common_client_location, common_client_asn, common_server_location, common_server_asn, common_sessions, common_c2s_pkt_num, common_s2c_pkt_num, common_c2s_byte_num, common_s2c_byte_num, common_c2s_pkt_diff, common_s2c_pkt_diff, common_c2s_byte_diff, common_s2c_byte_diff, common_schema_type, common_device_id, common_device_group, common_app_behavior, common_app_label, common_tunnels, common_protocol_label, common_l7_protocol, common_service_category, toDateTime(common_start_time) AS common_start_time, toDateTime(common_end_time) AS common_end_time, common_establish_latency_ms, common_con_duration_ms, common_stream_dir, common_stream_trace_id, common_c2s_ipfrag_num, common_s2c_ipfrag_num, common_c2s_tcp_lostlen, common_s2c_tcp_lostlen, common_c2s_tcp_unorder_num, common_s2c_tcp_unorder_num, common_c2s_pkt_retrans, common_s2c_pkt_retrans, common_c2s_byte_retrans, common_s2c_byte_retrans, common_tcp_client_isn, common_tcp_server_isn, toDateTime(common_processing_time) AS common_processing_time, toDateTime(common_ingestion_time) AS common_ingestion_time, http_url, http_host, common_server_domain, http_request_line, http_response_line, http_request_content_length, http_request_content_type, http_response_content_length, http_response_content_type, http_request_body, http_response_body, http_cookie, http_referer, http_user_agent, http_set_cookie, http_version, http_response_latency_ms, http_session_duration_ms, http_action_file_size, mail_protocol_type, mail_account, mail_from_cmd, mail_to_cmd, mail_from, mail_to, mail_cc, mail_bcc, mail_subject, mail_attachment_name, mail_eml_file, dns_message_id, dns_qr, dns_opcode, dns_aa, dns_tc, dns_rd, dns_ra, dns_rcode, dns_qdcount, dns_ancount, dns_nscount, dns_arcount, dns_qname, dns_qtype, dns_qclass, dns_sub, dns_response_latency_ms, ssl_sni, ssl_cn, ssl_pinningst, ssl_intercept_state, ssl_server_side_latency, ssl_client_side_latency, ssl_server_side_version, ssl_client_side_version, ssl_cert_verify, ssl_error, ssl_con_latency_ms, ssl_ja3_hash, ssl_cert_issuer, ssl_cert_subject, quic_version, quic_sni, quic_user_agent, ftp_account, ftp_url, ftp_content, ftp_link_type, app_extra_info, sip_call_id, sip_originator_description, sip_responder_description, sip_user_agent, sip_server, sip_originator_sdp_connect_ip, sip_originator_sdp_media_port, sip_originator_sdp_media_type, sip_originator_sdp_content, sip_responder_sdp_connect_ip, sip_responder_sdp_media_port, sip_responder_sdp_media_type, sip_responder_sdp_content, sip_duration_s, sip_bye, rtp_payload_type_c2s, rtp_payload_type_s2c, rtp_pcap_path, rtp_originator_dir, ssh_version, ssh_auth_success, ssh_client_version, ssh_server_version, ssh_cipher_alg, ssh_mac_alg, ssh_compression_alg, ssh_kex_alg, ssh_host_key_alg, ssh_host_key, ssh_hassh, stratum_cryptocurrency, stratum_mining_pools, stratum_mining_program FROM interim_session_record where  common_recv_time  >= @start and common_recv_time < @end  order by  common_recv_time desc  limit 100000
---Q19.Security Event Logs with fields
+--Q18.Security Event Logs with fields
 SELECT toDateTime(common_recv_time) AS common_recv_time, common_log_id, common_policy_id, common_subscriber_id, common_imei, common_imsi, common_phone_number, common_client_ip, common_internal_ip, common_client_port, common_l4_protocol, common_address_type, common_server_ip, common_server_port, common_external_ip, common_action, common_sled_ip, common_client_location, common_client_asn, common_server_location, common_server_asn, common_sessions, common_c2s_pkt_num, common_s2c_pkt_num, common_c2s_byte_num, common_s2c_byte_num, common_schema_type, common_device_id, common_device_group, common_app_behavior, common_app_label, common_tunnels, common_protocol_label, common_userdefine_app_name, common_l7_protocol, common_service_category, toDateTime(common_start_time) AS common_start_time, toDateTime(common_end_time) AS common_end_time, common_establish_latency_ms, common_con_duration_ms, common_stream_dir, common_stream_error, common_stream_trace_id, common_packet_capture_file, common_tcp_client_isn, common_tcp_server_isn, toDateTime(common_processing_time) AS common_processing_time, toDateTime(common_ingestion_time) AS common_ingestion_time, common_mirrored_pkts, common_mirrored_bytes, http_url, http_host, common_server_domain, http_request_line, http_response_line, http_request_content_length, http_request_content_type, http_response_content_length, http_response_content_type, http_request_body, http_response_body, http_cookie, http_referer, http_user_agent, http_set_cookie, http_version, http_response_latency_ms, http_action_file_size, http_session_duration_ms, mail_protocol_type, mail_account, mail_from_cmd, mail_to_cmd, mail_from, mail_to, mail_cc, mail_bcc, mail_subject, mail_attachment_name, dns_message_id, dns_qr, dns_opcode, dns_aa, dns_tc, dns_rd, dns_ra, dns_rcode, dns_qdcount, dns_ancount, dns_nscount, dns_arcount, dns_qname, dns_qtype, dns_qclass, dns_sub, ssl_sni, ssl_san, ssl_cn, ssl_pinningst, ssl_intercept_state, ssl_passthrough_reason, ssl_server_side_latency, ssl_client_side_latency, ssl_server_side_version, ssl_client_side_version, ssl_cert_verify, ssl_error, ssl_con_latency_ms, ssl_ja3_hash, ssl_cert_issuer, ssl_cert_subject, quic_version, quic_sni, quic_user_agent, ftp_account, ftp_url, ftp_content, ftp_link_type, app_extra_info, sip_call_id, sip_originator_description, sip_responder_description, sip_user_agent, sip_server, sip_originator_sdp_connect_ip, sip_originator_sdp_media_port, sip_originator_sdp_media_type, sip_originator_sdp_content, sip_responder_sdp_connect_ip, sip_responder_sdp_media_port, sip_responder_sdp_media_type, sip_responder_sdp_content, sip_duration_s, sip_bye, rtp_payload_type_c2s, rtp_payload_type_s2c, rtp_pcap_path, ssh_version, ssh_auth_success, ssh_client_version, ssh_server_version, ssh_cipher_alg, ssh_mac_alg, ssh_compression_alg, ssh_kex_alg, ssh_host_key_alg, ssh_host_key, ssh_hassh, stratum_cryptocurrency, stratum_mining_pools, stratum_mining_program from security_event where  common_recv_time  >= @start and common_recv_time < @end  order by  common_recv_time desc  limit 100000
---Q20.Radius ON/OFF Logs For Frame IP
+--Q19.Radius ON/OFF Logs For Frame IP
 select framed_ip, arraySlice(groupUniqArray(concat(toString(event_timestamp),':', if(acct_status_type=1,'start','stop'))),1,100000) as timeseries from radius_onff_log where event_timestamp >=toDateTime(@start) and event_timestamp <toDateTime(@end) group by framed_ip limit 20
---Q21.Radius ON/OFF Logs For Account
+--Q20.Radius ON/OFF Logs For Account
 select account, arraySlice(groupUniqArray(concat(toString(event_timestamp),':', if(acct_status_type=1,'start','stop'))),1,100000) as timeseries from radius_onff_log where event_timestamp >= toDateTime(@start) and event_timestamp < toDateTime(@end)  group by account
---Q22.Radius ON/OFF Logs total Account number
+--Q21.Radius ON/OFF Logs total Account number
 select count(distinct(framed_ip)) as active_ip_num , sum(acct_session_time) as online_duration from (select any(framed_ip) as framed_ip ,max(acct_session_time) as acct_session_time from radius_onff_log where account='000jS' and event_timestamp >= toDateTime(@start) and event_timestamp < toDateTime(@end)  group by acct_session_id)
---Q23.Radius ON/OFF Logs Account Access Detail
+--Q22.Radius ON/OFF Logs Account Access Detail
 select max(if(acct_status_type=1,event_timestamp,0)) as start_time,max(if(acct_status_type=2,event_timestamp,0)) as end_time, any(framed_ip) as ip,max(acct_session_time) as online_duration  from radius_onff_log where event_timestamp >= toDateTime(@start) and event_timestamp < toDateTime(@end)  group by acct_session_id  order by start_time desc limit 200
---Q24.Report for Client IP
+--Q23.Report for Client IP
 select common_client_ip, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@end))  group by common_client_ip order by sessions desc limit 0,100
---Q25.Report for Server IP
+--Q24.Report for Server IP
 select common_server_ip, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start))  group by common_server_ip order by sessions desc limit 0,100
---Q26.Report for SSL SNI
+--Q25.Report for SSL SNI
 select ssl_sni, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start))  group by ssl_sni order by sessions desc limit 0,100
---Q27.Report for SSL APP
+--Q26.Report for SSL APP
 select common_app_label as applicaiton, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start))  group by applicaiton order by sessions desc limit 0,100
---Q28.Report for Domains
+--Q27.Report for Domains
 select common_server_domain AS domain,SUM(coalesce(common_c2s_byte_num, 0)) AS sent_bytes,SUM(coalesce(common_s2c_byte_num, 0)) AS received_bytes,SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) AS bytes FROM session_record WHERE common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and notEmpty(domain)  GROUP BY domain ORDER BY bytes DESC LIMIT 100
---Q29.Report for Domains with unique Client IP
+--Q28.Report for Domains with unique Client IP
 select toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 300)*300) as stat_time, common_server_domain, uniq (common_client_ip) as nums  from session_record where common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start))  and common_server_domain in (select common_server_domain from session_record where common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start))  and notEmpty(common_server_domain) group by common_server_domain order by SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) desc limit 10 ) group by toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 300)*300), common_server_domain order by stat_time asc limit 500
---Q30. Report for HTTP Host
+--Q29.Report for HTTP Host
 SELECT http_host as host, SUM(coalesce(common_c2s_byte_num, 0)) AS sent_bytes,SUM(coalesce(common_s2c_byte_num, 0)) AS received_bytes,SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) AS bytes FROM session_record WHERE common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start))  and notEmpty(http_host) GROUP BY host ORDER BY bytes DESC limit 100 union all SELECT  'totals'  as host, SUM(coalesce(common_c2s_byte_num, 0)) AS sent_bytes, SUM(coalesce(common_s2c_byte_num, 0)) AS received_bytes, SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) AS bytes from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start))  and notEmpty(http_host)
---Q31.Report for HTTP/HTTPS URLS with Sessions
+--Q30.Report for HTTP/HTTPS URLS with Sessions
 SELECT http_url AS url,count(*) AS sessions FROM proxy_event WHERE common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and notEmpty(http_url) GROUP BY url ORDER BY sessions DESC LIMIT 100
---Q32.Report for HTTP/HTTPS URLS with UNIQUE Client IP
+--Q31.Report for HTTP/HTTPS URLS with UNIQUE Client IP
 select toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 300)*300) as stat_time, http_url, count(distinct(common_client_ip)) as nums  from proxy_event where common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and http_url IN (select http_url from proxy_event where common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and notEmpty(http_url)  group by http_url order by count(*) desc limit 10 ) group by toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 300)*300), http_url order by stat_time asc limit 500
---Q33.Report for Subscriber ID with Sessions
+--Q32.Report for Subscriber ID with Sessions
 select common_subscriber_id as user, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start))  and notEmpty(user)   group by common_subscriber_id order by sessions desc limit 0,100
---Q34.Report for Subscriber ID with Bandwidth
+--Q33.Report for Subscriber ID with Bandwidth
 SELECT common_subscriber_id as user,SUM(coalesce(common_c2s_byte_num, 0)) AS sent_bytes,SUM(coalesce(common_s2c_byte_num, 0)) AS received_bytes,SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) AS bytes FROM session_record WHERE common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) and notEmpty(user)   GROUP BY user ORDER BY bytes  DESC LIMIT 100
---Q35.Report Unique Endpoints
+--Q34.Report Unique Endpoints
 select uniq(common_client_ip) as "Client IP",uniq(common_server_ip) as "Server IP",uniq(common_internal_ip) as "Internal IP",uniq(common_external_ip) as "External IP",uniq(common_server_domain) as "Domain",uniq(ssl_sni) as "SNI"  from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start))
---Q36.TopN Optimizer
+--Q35.TopN Optimizer
 SELECT http_url AS url, SUM(common_sessions) AS sessions FROM session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND notEmpty(http_url) GROUP BY http_url ORDER BY sessions DESC limit 10
---Q37.All Security Event Hits Trend by 5min B
-select DATE_FORMAT(FROM_UNIXTIME(FLOOR(UNIX_TIMESTAMP(__time)/300)*300),'%Y-%m-%d %H:%i:%s') as start_time, sum(hits) as hits from security_event_hits_log where __time >= @start and __time < @end group by DATE_FORMAT(FROM_UNIXTIME(FLOOR(UNIX_TIMESTAMP(__time)/300)*300),'%Y-%m-%d %H:%i:%s') limit 10000
---Q38.Security Event Hit Time（first and last time) B
-select policy_id, DATE_FORMAT(min(__time) ,'%Y-%m-%d %H:%i:%s')  as first_used,  DATE_FORMAT(max(__time) ,'%Y-%m-%d %H:%i:%s') as last_used from security_event_hits_log where policy_id in (0) group by policy_id
---Q39.All Proxy Event Hits Trend by 5min B
-select FROM_UNIXTIME(FLOOR(UNIX_TIMESTAMP(__time)/300)*300) as start_time, sum(hits) as hits from proxy_event_hits_log where __time >= @start and __time < @end  group by  FROM_UNIXTIME(FLOOR(UNIX_TIMESTAMP(__time)/300)*300) limit 10000
---Q40.Proxy Event Hit Time（first and last time) B
-select policy_id, DATE_FORMAT(min(__time) ,'%Y-%m-%d %H:%i:%s')  as first_used,  DATE_FORMAT(max(__time) ,'%Y-%m-%d %H:%i:%s') as last_used from  proxy_event_hits_log where policy_id in (0) group by policy_id
---Q41.Traffic Composition Protocol Tree Trend
-(SELECT TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * TIME_FLOOR_WITH_FILL(TIMESTAMP_TO_MILLIS(__time)/1000, 'PT30S', 'zero')), 'yyyy-MM-dd HH:mm:ss') as stat_time, protocol_id as type, sum(c2s_byte_num + s2c_byte_num) as bytes from traffic_protocol_stat_log where __time >= @start AND __time < @end and protocol_id = 'ETHERNET' group by TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * TIME_FLOOR_WITH_FILL(TIMESTAMP_TO_MILLIS(__time)/1000, 'PT30S', 'zero')), 'yyyy-MM-dd HH:mm:ss'), protocol_id order by stat_time asc) union all (SELECT TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * TIME_FLOOR_WITH_FILL(TIMESTAMP_TO_MILLIS(__time)/1000, 'PT30S', 'zero')), 'yyyy-MM-dd HH:mm:ss') as stat_time, protocol_id as type, sum(c2s_byte_num + s2c_byte_num) as bytes from traffic_protocol_stat_log where __time >= @start AND __time < @end  and protocol_id like CONCAT('ETHERNET','.%') and LENGTH(protocol_id) = LENGTH(REPLACE(protocol_id,'.','')) + 1 + 0 group by TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * TIME_FLOOR_WITH_FILL(TIMESTAMP_TO_MILLIS(__time)/1000, 'PT30S', 'zero')), 'yyyy-MM-dd HH:mm:ss'), protocol_id order by stat_time asc)
---Q42.Traffic Metrics Security Action Hits Trend
-select FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1800S','zero'))  as statisticTime, sum(default_in_bytes + default_out_bytes) as default_bytes, sum(default_in_packets + default_out_packets) as default_packets, sum(default_conn_num) as default_sessions, sum(allow_in_bytes + allow_out_bytes) as allow_bytes, sum(allow_in_packets + allow_out_packets) as allow_packets, sum(allow_conn_num) as allow_sessions, sum(deny_in_bytes + deny_out_bytes) as deny_bytes, sum(deny_in_packets + deny_out_packets) as deny_packets, sum(deny_conn_num) as deny_sessions, sum(monitor_in_bytes + monitor_out_bytes) as monitor_bytes, sum(monitor_in_packets + monitor_out_packets) as monitor_packets, sum(monitor_conn_num) as monitor_sessions, sum(intercept_in_bytes + intercept_out_bytes) as intercept_bytes, sum(intercept_in_packets + intercept_out_packets) as intercept_packets, sum(intercept_conn_num) as intercept_sessions from traffic_metrics_log where __time >= @start and __time < @end group by FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1800S','zero')) limit 100000
---Q43.Traffic Metrics Proxy Action Hits Trend
-SELECT FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1800S','zero')) AS statisticTime,SUM(intcp_allow_num) AS intercept_allow_conn_num,SUM(intcp_mon_num) AS intercept_monitor_conn_num,SUM(intcp_deny_num) AS intercept_deny_conn_num,SUM(intcp_rdirt_num) AS intercept_redirect_conn_num,SUM(intcp_repl_num) AS intercept_replace_conn_num,SUM(intcp_hijk_num) AS intercept_hijack_conn_num,SUM(intcp_ins_num) AS intercept_insert_conn_num FROM traffic_metrics_log WHERE __time >= @start AND __time < @end GROUP BY FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time), 'PT1800S', 'zero')) LIMIT 100000
---Q44.Traffic Statistics(Metrics02)
-select FROM_UNIXTIME(stat_time) as max_active_date_by_sessions, total_live_sessions as max_live_sessions from ( select stat_time, sum(live_sessions) as total_live_sessions from ( select TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time), 'P1D') as stat_time, device_id, avg(established_conn_num) as live_sessions from traffic_metrics_log where __time >= @start and __time<@end group by TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time), 'P1D'), device_id) group by stat_time order by total_live_sessions desc limit 1 )
---Q45.Traffic Summary(Bandwidth Trend)
-select * from ( select DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s') as stat_time,'traffic_in_bytes' as type, sum(total_in_bytes) as bytes from traffic_metrics_log where __time >= @start and __time < @end group by DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s'), 'traffic_in_bytes' union all select DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s') as stat_time,'traffic_out_bytes' as type,sum(total_out_bytes) as bytes from traffic_metrics_log where __time >= @start and __time < @end group by DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s'),'traffic_out_bytes' ) order by stat_time asc limit 100000
---Q46.Traffic Summary(Sessions Trend)
-select DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s') as stat_time, 'total_conn_num' as type, sum(new_conn_num) as sessions from traffic_metrics_log where __time >= @start and __time < @end group by DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s'), 'total_conn_num' order by stat_time asc limit 10000
---Q47.Domain Baidu.com Metrics
+--Q36.Domain Baidu.com Metrics
 select FROM_UNIXTIME(min(common_recv_time)) as "First Seen" , FROM_UNIXTIME(max(common_recv_time)) as "Last Seen" ,  median(http_response_latency_ms) as "Server Processing Time Median(ms)", count(1) as Responses,any(common_server_location)  as Location from session_record WHERE  common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end)  AND  common_server_domain='baidu.com'
---Q48.TIME_FLOOR_WITH_FILL 01
+--Q37.TIME_FLOOR_WITH_FILL 01
 select "Device Group" as "Device Group" ,"Data Center" as "Data Center" ,FROM_UNIXTIME("End Time") as "End Time" , sum("counter") as "counter"  from (select common_device_group as "Device Group" ,common_data_center as "Data Center" ,TIME_FLOOR_WITH_FILL (common_end_time,'PT1H','zero') as "End Time" ,count(common_log_id) as "counter"  from session_record where   common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end)  group by "Device Group","Data Center","End Time") group by "Device Group" ,"Data Center" ,"End Time"  order by  "End Time" asc  limit 5
---Q49.TIME_FLOOR_WITH_FILL 02
+--Q38.TIME_FLOOR_WITH_FILL 02
 select FROM_UNIXTIME("End Time") as "End Time" , sum("counter") as "counter"  from (select common_device_group as "Device Group" ,common_data_center as "Data Center" ,TIME_FLOOR_WITH_FILL (common_end_time,'PT1H','zero') as "End Time" ,count(common_log_id) as "counter" ,count(common_server_domain) as "HTTP.Domain"  from security_event where   ((common_recv_time >= toDateTime('2021-10-19 00:00:00') and common_recv_time < toDateTime('2021-10-20 00:00:00'))  )  AND (  ( common_action = 2  ) ) group by "Device Group","Data Center","End Time") group by "End Time"  order by  "End Time" asc
---Q50.CONVERT_TZ (Druid) 01
-SELECT CONVERT_TZ('2019-09-09 09:09:09','GMT','MET') as test_time from proxy_event_hits_log limit 1
---Q51.CONVERT_TZ (Druid) 02
-SELECT CONVERT_TZ('2019-09-09 09:09:09','Europe/London','America/New_York') as test_time from proxy_event_hits_log limit 1
---Q52.CONVERT_TZ (Druid) 03
-SELECT CONVERT_TZ(now(),'GMT','America/New_York') as test_time from proxy_event_hits_log limit 1
---Q53.CONVERT_TZ (clickhouse) 01
+--Q39.CONVERT_TZ (clickhouse) 01
 SELECT CONVERT_TZ('2019-09-09 09:09:09','GMT','MET') as test_time from session_record limit 1
---Q54.CONVERT_TZ (clickhouse) 02
+--Q40.CONVERT_TZ (clickhouse) 02
 SELECT CONVERT_TZ('2019-09-09 09:09:09','Europe/London','America/New_York') as test_time from session_record limit 1
---Q55.CONVERT_TZ (clickhouse) 03
+--Q41.CONVERT_TZ (clickhouse) 03
 SELECT CONVERT_TZ(now(),'GMT','America/New_York') as test_time from session_record limit 1
---Q56.CONVERT_TZ (hbase) 01
+--Q42.CONVERT_TZ (hbase) 01
 SELECT CONVERT_TZ('2019-09-09 09:09:09','GMT','MET') as test_time from report_result limit 1
---Q57.CONVERT_TZ (hbase) 02
+--Q43.CONVERT_TZ (hbase) 02
 SELECT CONVERT_TZ('2019-09-09 09:09:09','Europe/London','America/New_York') as test_time from report_result limit 1
---Q58.CONVERT_TZ (hbase) 03
+--Q44.CONVERT_TZ (hbase) 03
 SELECT CONVERT_TZ(now(),'GMT','America/New_York') as test_time from report_result limit 1
---Q59.CONVERT_TZ (elasticsearch)
+--Q45.CONVERT_TZ (elasticsearch)
 SELECT CONVERT_TZ('2019-09-09 09:09:09','Europe/London','America/New_York') as time from report_result limit 1
---Q60.Authentication failed(code 516)
+--Q46.Authentication failed(code 516)
 SELECT toDateTime(common_recv_time) AS common_recv_time, common_log_id, common_subscriber_id, common_imei, common_imsi, common_phone_number, common_client_ip, common_internal_ip, common_client_port, common_l4_protocol, common_address_type, common_server_ip, common_server_port, common_external_ip, common_sled_ip, common_client_location, common_client_asn, common_server_location, common_server_asn, common_sessions, common_c2s_pkt_num, common_s2c_pkt_num, common_c2s_byte_num, common_s2c_byte_num, common_c2s_pkt_diff, common_s2c_pkt_diff, common_c2s_byte_diff, common_s2c_byte_diff, common_schema_type, common_device_id, common_device_group, common_app_behavior, common_app_label, common_tunnels, common_protocol_label, common_l7_protocol, common_service_category, toDateTime(common_start_time) AS common_start_time, toDateTime(common_end_time) AS common_end_time, common_establish_latency_ms, common_con_duration_ms, common_stream_dir, common_stream_trace_id, common_c2s_ipfrag_num, common_s2c_ipfrag_num, common_c2s_tcp_lostlen, common_s2c_tcp_lostlen, common_c2s_tcp_unorder_num, common_s2c_tcp_unorder_num, common_c2s_pkt_retrans, common_s2c_pkt_retrans, common_c2s_byte_retrans, common_s2c_byte_retrans, common_tcp_client_isn, common_tcp_server_isn, toDateTime(common_processing_time) AS common_processing_time, http_url, http_host, common_server_domain, http_request_content_length, http_request_content_type, http_response_content_length, http_response_content_type, http_request_body, http_response_body, http_cookie, http_referer, http_user_agent, http_set_cookie, http_version, http_response_latency_ms, http_session_duration_ms, http_action_file_size, mail_protocol_type, mail_account, mail_from_cmd, mail_to_cmd, mail_from, mail_to, mail_cc, mail_bcc, mail_subject, mail_attachment_name, mail_eml_file, dns_message_id, dns_qr, dns_opcode, dns_aa, dns_tc, dns_rd, dns_ra, dns_rcode, dns_qdcount, dns_ancount, dns_nscount, dns_arcount, dns_qname, dns_qtype, dns_qclass, dns_sub, ssl_sni, ssl_cn, ssl_pinningst, ssl_intercept_state, ssl_server_side_latency, ssl_client_side_latency, ssl_server_side_version, ssl_client_side_version, ssl_cert_verify, ssl_error, ssl_con_latency_ms, ssl_ja3_hash, ssl_cert_issuer, ssl_cert_subject, quic_version, quic_sni, quic_user_agent, ftp_account, ftp_url, ftp_content, ftp_link_type, app_extra_info, sip_call_id, sip_originator_description, sip_responder_description, sip_user_agent, sip_server, sip_originator_sdp_connect_ip, sip_originator_sdp_media_port, sip_originator_sdp_media_type, sip_originator_sdp_content, sip_responder_sdp_connect_ip, sip_responder_sdp_media_port, sip_responder_sdp_media_type, sip_responder_sdp_content, sip_duration_s, sip_bye, rtp_payload_type_c2s, rtp_payload_type_s2c, rtp_pcap_path, rtp_originator_dir, ssh_version, ssh_auth_success, ssh_client_version, ssh_server_version, ssh_cipher_alg, ssh_mac_alg, ssh_compression_alg, ssh_kex_alg, ssh_host_key_alg, ssh_host_key, ssh_hassh, stratum_cryptocurrency, stratum_mining_pools, stratum_mining_program FROM interim_session_record AS interim_session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time DESC LIMIT 43233, 20
---Q61.Function MAX_DURATION
+--Q47.Function MAX_DURATION
 SELECT destination_ip, IP_TO_GEO(destination_ip) AS destination_geo, MAX_DURATION(end_time,600) AS max_duration, any(destination_country) AS destination_country, groupUniqArray(arrayJoin(splitByString(',',source_country_list))) AS source_coutries,max(bit_rate) AS max_bit_rate,max(packet_rate) AS max_packet_rate,max(session_rate) AS max_session_rate,min(start_time) AS first_active_time,max(end_time) AS last_active_time,groupUniqArray(attack_type) AS attack_type,count(*) AS count from dos_event where start_time >= toUnixTimestamp(@start) AND start_time < toUnixTimestamp(@end) GROUP BY destination_ip ORDER BY count desc
---Q62.notEmpty(druid)
-SELECT device_id from traffic_metrics_log where __time >= @start and __time < @end AND notEmpty(device_id) limit 10
---Q63.empty(druid)
-SELECT device_id from traffic_metrics_log where __time >= @start and __time < @end AND empty(device_id) limit 10
---Q64.QUANTILE(clickhouse)
+--Q48.QUANTILE(clickhouse)
 SELECT QUANTILE(common_c2s_byte_num) AS c2s FROM session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND (common_l4_protocol IN ('IPv4_UDP', 'IPv6_UDP')) LIMIT 1
---Q65.QUANTILE(druid)
-SELECT QUANTILE(established_conn_num, 0.6) FROM traffic_metrics_log WHERE __time >= @start AND __time < @end limit 1
---Q66.Top Optimizer
+--Q49.Top Optimizer
 SELECT common_client_ip AS common_client_ip, count(*) AS count, sum(common_c2s_byte_num + common_s2c_byte_num) / 1024 / 1024 AS bytes_MB FROM session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) GROUP BY common_client_ip ORDER BY count DESC LIMIT 10
---Q67.IP_TO_GEO、IP_TO_ISP
+--Q50.IP_TO_GEO、IP_TO_ISP
 SELECT IP_TO_GEO(common_client_ip) AS geo, IP_TO_ISP(common_client_ip) AS isp FROM session_record LIMIT 1
---Q68.time format ISO8601, druid
-SELECT FROM_UNIXTIME(UNIX_TIMESTAMP('2023-02-08T00:00:00+0800')) FROM proxy_event_hits_log limit 1
---Q69.time format ISO8601, ck
+--Q51.time format ISO8601, ck
 SELECT FROM_UNIXTIME(UNIX_TIMESTAMP('2023-02-08T00:00:00+0800')) FROM session_record limit 1
---Q70.subQuery optimizing, filter field contain table name
-SELECT FROM_UNIXTIME(common_recv_time) AS stat_time FROM session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND (common_client_ip = '5.32.144.55') AND session_record.common_vsys_id IN (32, 1, 27, 4) ORDER BY common_recv_time DESC LIMIT 0, 50
\ No newline at end of file
+--Q52.subQuery optimizing, filter field contain table name
+SELECT FROM_UNIXTIME(common_recv_time) AS stat_time FROM session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND (common_client_ip = '5.32.144.55') AND session_record.common_vsys_id IN (32, 1, 27, 4) ORDER BY common_recv_time DESC LIMIT 0, 50
+--Q53.Concat Funtion Test sql
+select TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(common_recv_time),'PT1M','zero') as stat_time, (CASE WHEN common_action = 1 THEN 'Monitor' WHEN common_action = 2 THEN 'Intercept' WHEN common_action = 16 THEN 'Deny' WHEN common_action = 48 THEN 'Manipulation' WHEN common_action = 96 THEN 'Allow' WHEN common_action = 128 THEN 'Allow(Deprecated)' ELSE Concat(common_action) END) as type, count(*) as events from security_event where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) and common_vsys_id in (2,3) group by stat_time, common_action
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/meta_data.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/meta_data.json
index 40448669..655b026e 100644
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/meta_data.json
+++ b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/meta_data.json
@@ -42,13 +42,6 @@
       "namespace": "druid",
       "group": "DRUID_GROUP",
       "tables": [
-        "top_internal_host_log",
-        "top_client_ip_log",
-        "top_external_host_log",
-        "top_server_ip_log",
-        "top_website_domain_log",
-        "top_user_log",
-        "top_urls_log",
         "top_client_ips",
         "top_server_ips",
         "top_internal_ips",
@@ -57,13 +50,7 @@
         "top_server_fqdns",
         "top_subscribers",
         "application_protocol_stat",
-        "proxy_event_hits_log",
-        "security_event_hits_log",
-        "traffic_summary_log",
-        "traffic_protocol_stat_log",
-        "traffic_metrics_log",
         "traffic_general_stat",
-        "traffic_app_stat_log",
         "traffic_top_destination_ip_metrics_log",
         "traffic_shaping_rule_hits",
         "sys_storage_log",
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/proxy_event_hits_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/proxy_event_hits_log.json
deleted file mode 100644
index 710b713c..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/proxy_event_hits_log.json
+++ /dev/null
@@ -1,165 +0,0 @@
-{
-  "type": "record",
-  "name": "proxy_event_hits_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "isp",
-      "label": "ISP",
-      "type": "string",
-      "doc": {
-        "visibility": "disabled"
-      }
-    },
-    {
-      "name": "hits",
-      "label": "Hits",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "policy_id",
-      "label": "Policy ID",
-      "type": "long",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "action",
-      "label": "Action",
-      "doc": {
-        "visibility": "hidden"
-      },
-      "type": "long"
-    },
-    {
-      "name": "sub_action",
-      "label": "Action",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": [
-          {
-            "code": "allow",
-            "value": "Allow"
-          },
-          {
-            "code": "deny",
-            "value": "Deny"
-          },
-          {
-            "code": "monitor",
-            "value": "Monitor"
-          },
-          {
-            "code": "replace",
-            "value": "Replace"
-          },
-          {
-            "code": "redirect",
-            "value": "Redirect"
-          },
-          {
-            "code": "insert",
-            "value": "Insert"
-          },
-          {
-            "code": "hijack",
-            "value": "Hijack"
-          },
-          {
-            "code": "edit_element",
-            "value": "Edit Element"
-          },
-          {
-            "code": "run_script",
-            "value": "Run Script"
-          }
-        ],
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "ip_object",
-      "label": "IP Object",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "country",
-      "label": "Country",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "location",
-      "label": "Location",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/security_event_hits_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/security_event_hits_log.json
deleted file mode 100644
index 3af34c0f..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/security_event_hits_log.json
+++ /dev/null
@@ -1,137 +0,0 @@
-{
-  "type": "record",
-  "name": "security_event_hits_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "isp",
-      "label": "ISP",
-      "type": "string",
-      "doc": {
-        "visibility": "disabled"
-      }
-    },
-    {
-      "name": "policy_id",
-      "label": "Policy ID",
-      "type": "long",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "pinningst",
-      "label": "Pinning",
-      "type": "long",
-      "doc": {
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "action",
-      "label": "Action",
-      "type": "long",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": [
-          {
-            "code": "1",
-            "value": "Monitor"
-          },
-          {
-            "code": "2",
-            "value": "Intercept"
-          },
-          {
-            "code": "16",
-            "value": "Deny"
-          },
-          {
-            "code": "128",
-            "value": "Allow"
-          }
-        ],
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "hits",
-      "label": "Hits",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_client_ip_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_client_ip_log.json
deleted file mode 100644
index 978e1836..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_client_ip_log.json
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  "type": "record",
-  "name": "top_client_ip_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "source",
-      "label": "Client IP",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "session_num",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "order_by",
-      "label": "Order By",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_external_host_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_external_host_log.json
deleted file mode 100644
index 53581d66..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_external_host_log.json
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  "type": "record",
-  "name": "top_external_host_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "destination",
-      "label": "External IP",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "session_num",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "order_by",
-      "label": "Order By",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_internal_host_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_internal_host_log.json
deleted file mode 100644
index 9662c11f..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_internal_host_log.json
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  "type": "record",
-  "name": "top_internal_host_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "source",
-      "label": "Internal IP",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "session_num",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "order_by",
-      "label": "Order By",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_server_ip_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_server_ip_log.json
deleted file mode 100644
index 9e4014cf..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_server_ip_log.json
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  "type": "record",
-  "name": "top_server_ip_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "destination",
-      "label": "Server IP",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "session_num",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "order_by",
-      "label": "Order By",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_urls_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_urls_log.json
deleted file mode 100644
index eef7b6c7..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_urls_log.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "type": "record",
-  "name": "top_urls_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time"
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "url",
-      "label": "URL",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "session_num",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_user_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_user_log.json
deleted file mode 100644
index 721e6a6c..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_user_log.json
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  "type": "record",
-  "name": "top_user_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "subscriber_id",
-      "label": "Subscriber ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "session_num",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "order_by",
-      "label": "Order By",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_website_domain_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_website_domain_log.json
deleted file mode 100644
index 7d1d752f..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/top_website_domain_log.json
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  "type": "record",
-  "name": "top_website_domain_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "domain",
-      "label": "Domain",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "session_num",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "order_by",
-      "label": "Order By",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_app_stat_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_app_stat_log.json
deleted file mode 100644
index 9eb869a7..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_app_stat_log.json
+++ /dev/null
@@ -1,124 +0,0 @@
-{
-  "type": "record",
-  "name": "traffic_app_stat_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "app_name",
-      "label": "APP Name",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "session_num",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_metrics_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_metrics_log.json
deleted file mode 100644
index aa8c0d71..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_metrics_log.json
+++ /dev/null
@@ -1,449 +0,0 @@
-{
-  "type": "record",
-  "name": "traffic_metrics_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_id",
-      "label": "Device ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "allow_conn_num",
-      "label": "Allow Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "allow_in_bytes",
-      "label": "Allow Bytes (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "allow_in_packets",
-      "label": "Allow Packets (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "allow_out_bytes",
-      "label": "Allow Bytes (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "allow_out_packets",
-      "label": "Allow Packets (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "close_conn_num",
-      "label": "Closed Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "default_conn_num",
-      "label": "Default Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "default_in_bytes",
-      "label": "Default Bytes (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "default_in_packets",
-      "label": "Default Packets (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "default_out_bytes",
-      "label": "Default Bytes (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "default_out_packets",
-      "label": "Default Packets (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "deny_conn_num",
-      "label": "Deny Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "deny_in_bytes",
-      "label": "Deny Bytes (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "deny_in_packets",
-      "label": "Deny Packets (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "deny_out_bytes",
-      "label": "Deny Bytes (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "deny_out_packets",
-      "label": "Deny Packets (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intercept_conn_num",
-      "label": "Intercept Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intercept_in_bytes",
-      "label": "Intercept Bytes (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intercept_in_packets",
-      "label": "Intercept Packets (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intercept_out_bytes",
-      "label": "Intercept Bytes (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intercept_out_packets",
-      "label": "Intercept Packets (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "established_conn_num",
-      "label": "Established Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "monitor_conn_num",
-      "label": "Monitor Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "monitor_in_bytes",
-      "label": "Monitor Bytes (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "monitor_in_packets",
-      "label": "Monitor Packets (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "monitor_out_bytes",
-      "label": "Monitor Bytes (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "monitor_out_packets",
-      "label": "Monitor Packets (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "new_conn_num",
-      "label": "New Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "total_in_bytes",
-      "label": "Total Bytes (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "total_in_packets",
-      "label": "Total Packets (Ingress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "total_out_bytes",
-      "label": "Total Bytes (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "total_out_packets",
-      "label": "Total Packets (Egress)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "alert_bytes",
-      "label": "Alert Bytes",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "hijk_bytes",
-      "label": "Hijack Bytes",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "ins_bytes",
-      "label": "Insert Bytes",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_allow_num",
-      "label": "Intercept Allow Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_deny_num",
-      "label": "Intercept Deny Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_hijk_num",
-      "label": "Intercept Hijack Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_ins_num",
-      "label": "Intercept Insert Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_mon_num",
-      "label": "Intercept Monitor Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_rdirt_num",
-      "label": "Intercept Redirect Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_repl_num",
-      "label": "Intercept Replace Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "maybe_pinning_num",
-      "label": "Maybe Pinning Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "not_pinning_num",
-      "label": "Not Pinning Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "pinning_num",
-      "label": "Pinning Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "ad_cc_bytes",
-      "label": "AD CC Bytes",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "ad_flood_bytes",
-      "label": "AD Flood Bytes",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "ad_reflection_bytes",
-      "label": "AD Reflection Bytes",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_edit_elem_num",
-      "label": "Intercept Edit Element Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "intcp_rus_num",
-      "label": "Intercept Run Script Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_protocol_stat_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_protocol_stat_log.json
deleted file mode 100644
index 4d242f8d..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_protocol_stat_log.json
+++ /dev/null
@@ -1,189 +0,0 @@
-{
-  "type": "record",
-  "name": "traffic_protocol_stat_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "filters": [
-        "data_center",
-        "device_group"
-      ],
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "protocol_id",
-      "label": "Protocol ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "app_name",
-      "label": "APP Name",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "isp",
-      "label": "ISP",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,!="
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,!="
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "sessions",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_ipfrag_num",
-      "label": "Fragmentation Packets (c2s)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_ipfrag_num",
-      "label": "Fragmentation Packets (s2c)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_tcp_lostlen",
-      "label": "Sequence Gap Loss (c2s)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_tcp_lostlen",
-      "label": "Sequence Gap Loss (s2c)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_tcp_unorder_num",
-      "label": "Unordered Packets (c2s)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_tcp_unorder_num",
-      "label": "Unordered Packets (s2c)",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_summary_log.json b/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_summary_log.json
deleted file mode 100644
index 7234a298..00000000
--- a/config/nacos/config/fixed-127.0.0.1_8848-tsg_nacos/data/config-data-tenant/tsg/Galaxy/traffic_summary_log.json
+++ /dev/null
@@ -1,215 +0,0 @@
-{
-  "type": "record",
-  "name": "traffic_summary_log",
-  "namespace": "druid",
-  "doc": {
-    "partition_key": "__time",
-    "functions": {
-      "$ref": "public_schema_info.json#/functions"
-    },
-    "schema_query": {
-      "references": {
-        "$ref": "public_schema_info.json#/schema_query/references"
-      }
-    }
-  },
-  "fields": [
-    {
-      "name": "__time",
-      "label": "Time",
-      "type": {
-        "type": "string",
-        "logicalType": "timestamp"
-      },
-      "doc": {
-        "constraints": {
-          "type": "timestamp"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "data_center",
-      "label": "Data Center",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagValue']",
-          "value": "$[?(@.tagType=='data_center')].subTags.[?(@.tagType=='data_center')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "device_group",
-      "label": "Device Group",
-      "type": "string",
-      "doc": {
-        "constraints": {
-          "operator_functions": "=,in"
-        },
-        "data": {
-          "$ref": "device_tag.json#",
-          "key": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagValue']",
-          "value": "$[?(@.tagType=='device_group')].subTags.[?(@.tagType=='device_group')]['tagName']"
-        },
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "vsys_id",
-      "label": "Vsys ID",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "int",
-      "default": 1
-    },
-    {
-      "name": "isp",
-      "label": "ISP",
-      "type": "string",
-      "doc": {
-        "visibility": "disabled"
-      }
-    },
-    {
-      "name": "schema_type",
-      "label": "Schema Type",
-      "type": "string",
-      "doc": {
-        "data": [
-          {
-            "code": "BASE",
-            "value": "BASE"
-          },
-          {
-            "code": "MAIL",
-            "value": "MAIL"
-          },
-          {
-            "code": "DNS",
-            "value": "DNS"
-          },
-          {
-            "code": "HTTP",
-            "value": "HTTP"
-          },
-          {
-            "code": "SSL",
-            "value": "SSL"
-          },
-          {
-            "code": "QUIC",
-            "value": "QUIC"
-          },
-          {
-            "code": "FTP",
-            "value": "FTP"
-          },
-          {
-            "code": "SSH",
-            "value": "SSH"
-          },
-          {
-            "code": "Stratum",
-            "value": "Stratum"
-          }
-        ],
-        "visibility": "enabled"
-      }
-    },
-    {
-      "name": "ip_object",
-      "label": "IP Object",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "string"
-    },
-    {
-      "name": "sessions",
-      "label": "Sessions",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_byte_num",
-      "label": "Bytes Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_byte_num",
-      "label": "Bytes Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "c2s_pkt_num",
-      "label": "Packets Sent",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "s2c_pkt_num",
-      "label": "Packets Received",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "one_sided_connections",
-      "label": "One Sided Connections",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "uncategorized_bytes",
-      "label": "Uncategorized Bytes",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "fragmentation_packets",
-      "label": "Fragmentation Packets",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "sequence_gap_loss",
-      "label": "Sequence Gap Loss",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    },
-    {
-      "name": "unorder_packets",
-      "label": "Unorder Packets",
-      "doc": {
-        "visibility": "enabled"
-      },
-      "type": "long"
-    }
-  ]
-}
\ No newline at end of file