[[rule]]
id = 0x4001
symptom = "选择了更差的执行计划"
description = "选择了更差的执行计划"
kb = []
jira = []
version = ""
  [rule.patterns]
  query = """{
    "size": 0,
    "query": {
        "bool": {
            "filter": [
                {
                    "range": {
                        "process_keys": {
                            "gte": 1000000
                        }
                    }
                },
                {
                    "range": {
                        "timestamp": {
                            "gte": %d,
                            "lt": %d
                        }
                    }
                }
            ]
        }
    },
    "fields": [
        "digest.keyword",
        "plan_digest.keyword",
        "timestamp",
        {
            "field": "timestamp",
            "format": "epoch_millis"
        },
        "process_time",
        "process_keys"
    ],
    "aggs": {
        "sql": {
            "terms": {
                "field": "digest.keyword"
            },
            "aggs": {
                "plan_detail": {
                    "terms": {
                        "field": "plan_digest.keyword"
                    },
                    "aggs": {
                        "avg_p_time": {
                            "avg": {
                                "field": "process_time"
                            }
                        },
                        "last_time": {
                            "max": {
                                "field": "timestamp",
                                "format": "epoch_millis"
                            }
                        }
                    }
                },
                "max_avg_p_time": {
                    "max_bucket": {
                        "buckets_path": "plan_detail>avg_p_time"
                    }
                },
                "min_avg_p_time": {
                    "min_bucket": {
                        "buckets_path": "plan_detail>avg_p_time"
                    }
                },
                "filter_multi_plan": {
                    "bucket_selector": {
                        "buckets_path": {
                            "count": "plan_detail._bucket_count",
                            "max_time": "max_avg_p_time",
                            "min_time": "min_avg_p_time"
                        },
                        "script": {
                            "source": "params.count > 1 && params.max_time >= 50*params.min_time"
                        }
                    }
                }
            }
        }
    },
    "_source": false
}"""

[[rule]]
id = 0x4002
symptom = "高频更新同一行数据"
description = "高频更新同一行数据"
kb = []
jira = []
version = ""

  [rule.patterns]
  query = """{
    "size": 0,
    "query": {
        "bool": {
            "filter": [
                {
                    "script": {
                        "script": {
                            "source": "doc['total_keys'].value > params['a'] * doc['process_keys'].value && doc['process_keys'].value > params['b']",
                            "params": {
                                "a": 2,
                                "b": 10000
                            }
                        }
                    }
                },
                {
                    "range": {
                        "timestamp": {
                            "gte": %d,
                            "lt": %d
                        }
                    }
                }
            ]
        }
    },
    "fields": [
        "digest.keyword",
        "plan_digest.keyword",
        "timestamp",
        "process_keys"
    ],
    "aggs": {
        "sql": {
            "terms": {
                "field": "digest.keyword"
            },
            "aggs": {
                "plan_detail": {
                    "terms": {
                        "field": "plan_digest.keyword"
                    }
                }
            }
        }
    },
    "_source": false
}"""

[[rule]]
id = 0x4003
symptom = "扫到过多无效数据"
description = "扫到过多无效数据"
kb = []
jira = []
version = ""

[rule.patterns]
query = """{
    "size": 0,
    "query": {
        "bool": {
            "filter": [
                {
                    "script": {
                        "script": {
                            "source": "Math.abs(doc['rocksdb_delete_skipped_count'].value - doc['process_keys'].value) <= params['a'] && doc['process_keys'].value > params['b']",
                            "params": {
                                "a": 1000,
                                "b": 10000
                            }
                        }
                    }
                },
                {
                    "range": {
                        "timestamp": {
                            "gte": %d,
                            "lt": %d
                        }
                    }
                }
            ]
        }
    },
    "fields": [
        "digest.keyword",
        "plan_digest.keyword",
        "timestamp",
        "process_keys"
    ],
    "aggs": {
        "sql": {
            "terms": {
                "field": "digest.keyword"
            },
            "aggs": {
                "plan_detail": {
                    "terms": {
                        "field": "plan_digest.keyword"
                    }
                }
            }
        }
    },
    "_source": false
}"""