安全扫描实例明细分析

Prompt:
## Prompt
任务目标：从安全扫描 span 信息和资源分配信息关联产出安全扫描实例运行明细表。

输入：
- internal_platform_db.t_security_scan_span_prestosql_001
- internal_platform_db.t_security_resource_info_prestosql_001

处理规则：
- 两表关联查询，关联条件需基于表结构确定
- 具体过滤条件和字段选择需基于表结构确定

输出要求：
- 输出表：internal_platform_db.t_security_scan_instance_detail_cand_prestosql_001
- 输出字段需基于目标表结构确定

写入要求：
- 写入目标表

请将最终 Presto/Trino SQL 写入 result.sql 并执行。

INSERT INTO internal_platform_db.t_security_scan_instance_detail_prestosql_001
WITH base_trace AS (
    SELECT trace_id
    FROM internal_platform_db.t_security_scan_span_prestosql_001
    WHERE databus_imp_date >= '2026060600'
      AND databus_imp_date <= '2026060800'
      AND span_name IN ('scan.completed', 'scan.failed')
    GROUP BY trace_id
    HAVING
        COUNT(CASE WHEN span_name = 'scan.failed' THEN 1 END) > 0
        AND
        COUNT(CASE WHEN span_name = 'scan.completed' THEN 1 END) = 0
),
combined_spans AS (
    SELECT
        trace_id,
        span_name,
        start_time,
        end_time,
        security_project_id,
        security_task_id,
        scan_type,
        status_code
    FROM internal_platform_db.t_security_scan_span_prestosql_001
    WHERE databus_imp_date >= '2026060600'
      AND databus_imp_date <= '2026060800'
      AND trace_id IN (SELECT trace_id FROM base_trace)
      AND span_name IN ('scan.failed', 'scan.start', 'scan.execute', 'scan.cleanup', 'resource.allocate')

    UNION ALL

    SELECT
        trace_id,
        'scan.completed' AS span_name,
        MAX(CASE WHEN span_name = 'scan.start' THEN start_time END) AS start_time,
        MAX(CASE WHEN span_name = 'scan.failed' THEN end_time END) AS end_time,
        MAX(CASE WHEN span_name = 'scan.failed' THEN security_project_id END) AS security_project_id,
        MAX(CASE WHEN span_name = 'scan.failed' THEN security_task_id END) AS security_task_id,
        MAX(CASE WHEN span_name = 'scan.failed' THEN scan_type END) AS scan_type,
        2 AS status_code
    FROM internal_platform_db.t_security_scan_span_prestosql_001
    WHERE databus_imp_date >= '2026060600'
      AND databus_imp_date <= '2026060800'
      AND trace_id IN (SELECT trace_id FROM base_trace)
      AND span_name IN ('scan.start', 'scan.failed')
    GROUP BY trace_id
),
base_data_time_fixed AS (
    SELECT
        trace_id,
        span_name,
        CASE
            WHEN span_name = 'scan.failed'
                THEN MIN(CASE WHEN span_name IN ('scan.execute', 'scan.failed') THEN start_time END)
                        OVER(PARTITION BY trace_id)
                ELSE start_time
        END AS start_time,
        end_time,
        security_project_id,
        security_task_id,
        scan_type,
        status_code
    FROM combined_spans
),
base_data AS (
    SELECT
        trace_id,
        span_name,
        start_time,
        end_time,
        security_project_id,
        security_task_id,
        scan_type,
        status_code,
        from_unixtime(CAST(start_time AS BIGINT) / 1000) AS start_date,
        from_unixtime(CAST(end_time AS BIGINT) / 1000) AS end_date,
        date_diff('day', from_unixtime(CAST(start_time AS BIGINT) / 1000), from_unixtime(CAST(end_time AS BIGINT) / 1000)) AS diff_days,
        CAST(CAST(start_time AS BIGINT) / 86400000 AS BIGINT) * 86400000 AS start_day_midnight_ms
    FROM base_data_time_fixed
),
pos_series AS (
    SELECT 0 AS pos UNION ALL SELECT 1 AS pos UNION ALL SELECT 2 AS pos UNION ALL SELECT 3 AS pos
),
daily_split_spans AS (
    SELECT
        b.trace_id,
        b.span_name,
        b.security_project_id,
        b.security_task_id,
        b.scan_type,
        b.status_code,
        b.start_date,
        b.end_date,
        b.diff_days,
        date_add('day', s.pos, b.start_date) AS calc_date,
        CASE WHEN s.pos = 0 THEN b.start_time
             ELSE CAST(b.start_day_midnight_ms + s.pos * 86400000 AS VARCHAR)
        END AS start_time,
        CASE WHEN s.pos = b.diff_days THEN b.end_time
             ELSE CAST(b.start_day_midnight_ms + (s.pos + 1) * 86400000 - 1 AS VARCHAR)
        END AS end_time,
        b.start_time AS span_start_time,
        b.end_time AS span_end_time
    FROM base_data b
    INNER JOIN pos_series s ON s.pos <= b.diff_days
),
trace_time_metrics AS (
    SELECT
        t.trace_id,
        t.calc_date,
        MAX(t.security_project_id) AS security_project_id,
        MAX(t.security_task_id) AS security_task_id,
        MAX(t.scan_type) AS scan_type,
        MAX(MAX(CASE WHEN t.span_name = 'scan.completed' THEN t.status_code END)) OVER(PARTITION BY t.trace_id) AS status_code,
        CAST(ROUND((MAX(CASE WHEN t.span_name = 'scan.execute' THEN CAST(t.end_time AS BIGINT) END) -
                    MIN(CASE WHEN t.span_name = 'scan.execute' THEN CAST(t.start_time AS BIGINT) END)) / 1000.0) AS INT) AS scan_run_time,
        CAST(ROUND((MAX(CASE WHEN t.span_name IN ('scan.execute', 'scan.cleanup') THEN CAST(t.end_time AS BIGINT) END) -
                    MIN(CASE WHEN t.span_name IN ('scan.execute', 'scan.cleanup') THEN CAST(t.start_time AS BIGINT) END)) / 1000.0) AS INT) AS code_run_time,
        CAST(ROUND((MAX(CASE WHEN t.span_name = 'resource.allocate' THEN CAST(t.end_time AS BIGINT) END) -
                    MIN(CASE WHEN t.span_name = 'resource.allocate' THEN CAST(t.start_time AS BIGINT) END)) / 1000.0) AS INT) AS resource_wait_time
    FROM daily_split_spans t
    GROUP BY t.trace_id, t.calc_date
)
SELECT
    date_format(t1.calc_date, '%Y-%m-%d') AS p_date,
    t1.trace_id,
    t1.security_project_id,
    t1.security_task_id,
    t1.scan_type,
    t1.status_code,
    t1.scan_run_time,
    t1.code_run_time,
    t1.resource_wait_time,
    t2.resource_id,
    CAST(t2.is_dedicated AS BOOLEAN) AS is_dedicated,
    t2.apply_for_cpu_count
FROM trace_time_metrics t1
LEFT JOIN (
    SELECT
        trace_id,
        MAX(resource_id) AS resource_id,
        MAX(is_dedicated) AS is_dedicated,
        MAX(cpu_cores) AS apply_for_cpu_count
    FROM internal_platform_db.t_security_resource_info_prestosql_001
    WHERE databus_imp_date >= '2026060600'
      AND databus_imp_date <= '2026060800'
    GROUP BY trace_id
) t2 ON t1.trace_id = t2.trace_id
;


Ad ASA Attribution Migration

Prompt:
## Prompt
**Task Objective**: From the ad attribution raw logs, filter valid records of two attribution types (ad_attribution and huawei), aggregate the log count and deduplicated user count by version and media dimensions, and write the results to the output table.

**Input Table**:
- `internal_platform_db.t_sh_event_log_v2_06000061157_prestosql_002` (ad attribution raw logs)
  - `ftime` STRING — time
  - `extinfo` STRING — extended information
  - `ad_version` STRING — ad version (ad_attribution/huawei)
  - `guid` STRING — user identifier
  - `ch` STRING — channel
  - `first_date` STRING — first date
  - `last_date` STRING — last date
  - `click_date` STRING — click date
  - `attribution` STRING — attribution flag
  - `conversion_date` STRING — conversion date
  - `conversion_type` STRING — conversion type
  - `creativeset_id` STRING — creative set ID
  - `org_id` STRING — organization ID
  - `campaign_id` STRING — campaign ID
  - `adgroup_id` STRING — ad group ID
  - `keyword_id` STRING — keyword ID
  - `country_oregion` STRING — country/region
  - `enter_ag_time` STRING — ad group entry time
  - `installed_finish_time` STRING — installation completion time
  - `start_download_time` STRING — download start time
  - `sub_channel` STRING — sub-channel
  - `callback` STRING — callback information
  - `task_id` STRING — task ID
  - `sub_task_id` STRING — sub-task ID
  - `rta_id` STRING — RTA identifier
  - `device_id` STRING — device_id identifier
  - `ext_info1` STRING — extended information 1
  - `ext_info2` STRING — extended information 2
  - `caid` STRING — CAID
  - `claim_type` STRING — claim type
  - `ai_assistant_device_id` STRING — YB device_id
  - `ds` STRING — partition field

**Filter Conditions**:
- `ds = '2026060919'`
- Valid record condition: `(ad_version = 'ad_attribution' AND attribution = 'true') OR (ad_version = 'phonebrandh' AND callback != '')`

**Output Requirements**:
- Target table: `internal_platform_db.t_my_ads_tracking_log_metrics_cand_prestosql_002`
- Output fields and order: `ds` BIGINT, `ad_version` STRING, `media_id` INT, `log_num` BIGINT, `log_num_qimei` BIGINT
- `ds`: Cast the original table's `ds` field to BIGINT
- `media_id`: `CASE ad_version WHEN 'ad_attribution' THEN 39 WHEN 'phonebrandh' THEN 28 END`
- `log_num`: `COUNT(*)` log count
- `log_num_qimei`: `COUNT(DISTINCT device_id)` deduplicated user count
- Group by `ds`, `ad_version`
- If the target table does not exist, first create the table, then write the data
- Use Presto/Trino SQL syntax; do not use Hive/Spark SQL dialects

**Environment and Execution Notes**:
- Presto is running, connected via the Hive catalog
- Execute SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- After writing `result.sql`, you must execute it yourself to verify that it runs successfully and produces correct data

INSERT OVERWRITE TABLE internal_platform_db.t_my_ads_tracking_log_metrics_prestosql_002
SELECT
  CAST(ds AS BIGINT) AS ds,
  ad_version,
  CASE ad_version WHEN 'ad_attribution' THEN 39 WHEN 'phonebrandh' THEN 28 END AS media_id,
  COUNT(*) AS log_num,
  COUNT(DISTINCT device_id) AS log_num_qimei
FROM internal_platform_db.t_sh_event_log_v2_06000061157_prestosql_002
WHERE ds = '2026060919'
  AND ((ad_version = 'ad_attribution' AND attribution = 'true')
    OR (ad_version = 'phonebrandh' AND callback != ''))
GROUP BY ds, ad_version


IM平台Q群离线报告子分区过滤

Prompt:
## Prompt
**任务目标**：从IM平台Q群离线报告原始日志中，筛选指定appid下包含"诈骗"标签的记录，提取关键字段写入输出表。

**输入表**：
- `internal_platform_db.dwd_t_event_log_v1_05900072467_with_subpartition_hi_prestosql_003`（IM平台Q群离线报告原始日志）
  - `databus_imp_date` STRING — 数据日期
  - `ftime` STRING — 时间
  - `appid` STRING — 应用ID
  - `message_id` STRING — 消息ID
  - `reqbody` STRING — 请求体(JSON)
  - `content` STRING — 内容
  - `model_id` STRING — 模型ID
  - `group_num` STRING — 群号
  - `punish_path_name` STRING — 处罚路径名称
  - `ext_field1` STRING — 扩展字段1
  - `ext_field2` STRING — 扩展字段2
  - `ds` BIGINT — 分区字段

**过滤条件**：
- `appid = '100553'`
- `reqbody IS NOT NULL`
- `get_json_object(reqbody, '$.tag_info') IS NOT NULL`
- `get_json_object(reqbody, '$.tag_info.tag_result_text') LIKE '%诈骗-%'`
- `ftime = '20250324'`

**输出要求**：
- 目标表: `internal_platform_db.dwd_qqgroup_offline_report_cand_prestosql_003`
- 输出字段及顺序: `ftime` STRING, `appid` STRING, `model_id` STRING, `message_id` STRING, `databus_imp_date` STRING, `group_num` STRING, `punish_path_name` STRING, `content` STRING
- appid 固定值 '101069'
- model_id 固定值 'IM平台Qgroup_zhapian_report_1049'
- 如果目标表不存在，请先建表再写入数据
- 请使用Presto/Trino SQL语法，不要使用Hive/Spark SQL方言
- 注意：Presto中使用json_extract_scalar代替get_json_object

**环境与执行说明**：
- Presto已启动，通过Hive catalog连接
- 执行SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- 写出result.sql后，必须自己执行验证它能成功运行并产出正确数据

INSERT OVERWRITE TABLE internal_platform_db.dwd_qqgroup_offline_report_prestosql_003
SELECT
  ftime,
  '101069' AS appid,
  'IM平台Qgroup_zhapian_report_1049' AS model_id,
  message_id,
  databus_imp_date,
  group_num,
  punish_path_name,
  content
FROM internal_platform_db.dwd_t_event_log_v1_05900072467_with_subpartition_hi_prestosql_003
WHERE appid = '100553'
  AND reqbody IS NOT NULL
  AND get_json_object(reqbody, '$.tag_info') IS NOT NULL
  AND get_json_object(reqbody, '$.tag_info.tag_result_text') LIKE '%诈骗-%'
  AND ftime = '20250324'


小说UDS算法书籍关系筛选

Prompt:
## Prompt
**任务目标**：从小说UDS算法书籍关系表中，筛选指定事件类型的记录，根据事件类型映射为操作类型，提取关键字段写入输出表。

**输入表**：
- `internal_platform_db.t_oh_novel_uds_algorithm_book_rel_prestosql_004`（小说UDS算法书籍关系表）
  - `ftime` STRING — 时间
  - `event_code` STRING — 事件编码
  - `book_id` STRING — 书籍ID
  - `guid` STRING — 用户标识
  - `reqid` STRING — 请求ID
  - `traceid` STRING — 追踪ID
  - `report_time` STRING — 上报时间
  - `ds` BIGINT — 分区字段

**过滤条件**：
- `ds = 2026060906`
- `length(book_id) = 10`
- `event_code IN ('expose', 'click', 'real_read', 'add_0', 'add_1', 'shelf_add', 'share', 'comment', 'like')`

**输出要求**：
- 目标表: `internal_platform_db.t_od_novel_user_action_detail_cand_prestosql_004`
- 输出字段及顺序: `reqid` STRING, `guid` STRING, `bookid` STRING, `traceid` STRING, `action` STRING, `ftime` STRING, `report_time` STRING
- action: CASE event_code WHEN 'expose' THEN 'expose' WHEN 'click' THEN 'click' WHEN 'real_read' THEN 'real_read' WHEN 'add_0' THEN 'add_0' WHEN 'add_1' THEN 'add_1' ELSE event_code END
- bookid: book_id
- traceid: substr(traceid, 1, 4)
- 如果目标表不存在，请先建表再写入数据
- 请使用Presto/Trino SQL语法，不要使用Hive/Spark SQL方言

**环境与执行说明**：
- Presto已启动，通过Hive catalog连接
- 执行SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- 写出result.sql后，必须自己执行验证它能成功运行并产出正确数据

INSERT OVERWRITE TABLE internal_platform_db.t_od_novel_user_action_detail_prestosql_004
SELECT
  reqid,
  guid,
  book_id AS bookid,
  substr(traceid, 1, 4) AS traceid,
  CASE event_code
    WHEN 'expose' THEN 'expose'
    WHEN 'click' THEN 'click'
    WHEN 'real_read' THEN 'real_read'
    WHEN 'add_0' THEN 'add_0'
    WHEN 'add_1' THEN 'add_1'
    ELSE event_code
  END AS action,
  ftime,
  report_time
FROM internal_platform_db.t_oh_novel_uds_algorithm_book_rel_prestosql_004
WHERE ds = 2026060906
  AND length(book_id) = 10
  AND event_code IN ('expose', 'click', 'real_read', 'add_0', 'add_1', 'shelf_add', 'share', 'comment', 'like')


Hot Table Governance Metadata Wide Table Aggregation

Prompt:
## Prompt
**Task Objective**: From the hot table governance metadata detail table, filter valid hot table records (heat > 0, excluding temporary/test tables), aggregate by database name and table name to take the maximum of each metric, and write the results to the output table.

**Input Table**:
- `internal_platform_db.ads_gov_cost_table_govern_detail_df_prestosql_005` (hot table governance metadata detail table)
  - `imp_date` BIGINT — date partition
  - `db_name` STRING — database name
  - `table_name` STRING — table name
  - `heat` BIGINT — heat
  - `owner` STRING — owner
  - `storage_detail` DOUBLE — storage detail
  - `task_cnt` BIGINT — task count
  - `table_type` STRING — table type
  - `govern_status` STRING — governance status
  - `last_access_time` STRING — last access time
  - `table_comment` STRING — table comment
  - `partition_cnt` BIGINT — partition count
  - `file_format` STRING — file format
  - `table_size` DOUBLE — table size
  - `avg_file_size` DOUBLE — average file size
  - `is_partitioned` INT — whether partitioned
  - `lifecycle_days` INT — lifecycle days
  - `create_time` STRING — creation time
  - `modify_time` STRING — modification time
  - `project_name` STRING — project name

**Filter Conditions**:
- `imp_date = 20260507`
- `heat > 0`
- `table_name NOT LIKE '%temp%'`
- `db_name NOT LIKE '%test%'`

**Output Requirements**:
- Target table: `internal_platform_db.dwd_hot_metadata_table_cand_prestosql_005`
- Output fields and order: `dt` STRING, `db_name` STRING, `table_name` STRING, `owner` STRING, `storage_detail` DOUBLE, `heat` BIGINT, `task_cnt` BIGINT, `table_type` STRING, `govern_status` STRING, `last_access_time` STRING, `table_comment` STRING, `partition_cnt` BIGINT, `file_format` STRING, `table_size` DOUBLE, `avg_file_size` DOUBLE, `is_partitioned` INT, `lifecycle_days` INT, `create_time` STRING, `modify_time` STRING, `project_name` STRING
- `dt`: Fixed value `'20260507'`
- Group by `db_name`, `table_name`, apply `MAX()` to all other fields
- If the target table does not exist, first create the table, then write the data
- Use Presto/Trino SQL syntax; do not use Hive/Spark SQL dialects

**Environment and Execution Notes**:
- Presto is running, connected via the Hive catalog
- Execute SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- After writing `result.sql`, you must execute it yourself to verify that it runs successfully and produces correct data

INSERT OVERWRITE TABLE internal_platform_db.dwd_hot_metadata_table_prestosql_005
SELECT
  '20260507' AS dt,
  db_name,
  table_name,
  MAX(owner) AS owner,
  MAX(storage_detail) AS storage_detail,
  MAX(heat) AS heat,
  MAX(task_cnt) AS task_cnt,
  MAX(table_type) AS table_type,
  MAX(govern_status) AS govern_status,
  MAX(last_access_time) AS last_access_time,
  MAX(table_comment) AS table_comment,
  MAX(partition_cnt) AS partition_cnt,
  MAX(file_format) AS file_format,
  MAX(table_size) AS table_size,
  MAX(avg_file_size) AS avg_file_size,
  MAX(is_partitioned) AS is_partitioned,
  MAX(lifecycle_days) AS lifecycle_days,
  MAX(create_time) AS create_time,
  MAX(modify_time) AS modify_time,
  MAX(project_name) AS project_name
FROM internal_platform_db.ads_gov_cost_table_govern_detail_df_prestosql_005
WHERE imp_date = 20260507
  AND heat > 0
  AND table_name NOT LIKE '%temp%'
  AND db_name NOT LIKE '%test%'
GROUP BY db_name, table_name


News Plugin Send Process Multi-Dimensional Aggregation

Prompt:
## Prompt
**Task Objective**: From the news plugin send process flow table, aggregate and compute metrics such as send count, send UV, panel exposure count, panel exposure UV, inner-page PV, and inner-page UV by the scene (`pos_desc`) dimension, across two time windows — current day and last 1 hour — and write the results to the output table.

**Input Table**:
- `internal_platform_db.dwm_news_plugin_ai_assistant_send_process_flow_hi_prestosql_006` (news plugin send process flow table)
  - `imp_hour` BIGINT — hourly partition
  - `user_id` STRING — user ID
  - `content_id` STRING — content ID
  - `push_id` STRING — push ID
  - `pos` STRING — position
  - `send_cnt` BIGINT — send count
  - `panel_exp_cnt` BIGINT — panel exposure count
  - `pgin_pv` BIGINT — inner-page PV
  - `pos_desc` STRING — position description (scene)
  - `account_code` STRING — business code

**Output Requirements**:
- Target table: `internal_platform_db.ads_news_plugin_ai_assistant_hourly_report_cand_prestosql_006`
- Output fields and order:
  - `imp_hour` BIGINT — hourly partition
  - `scene` STRING — scene (`pos_desc`)
  - `send_cnt_dth` BIGINT — current day send count (`SUM(send_cnt) WHERE imp_hour <= current hour`)
  - `send_uv_dth` BIGINT — current day send UV (`COUNT(DISTINCT user_id) WHERE imp_hour <= current hour`)
  - `panel_exp_cnt_dth` BIGINT — current day panel exposure count (`SUM(panel_exp_cnt) WHERE imp_hour <= current hour`)
  - `panel_exp_uv_dth` BIGINT — current day panel exposure UV (`COUNT(DISTINCT user_id) WHERE panel_exp_cnt > 0 AND imp_hour <= current hour`)
  - `pgin_pv_dth` BIGINT — current day inner-page PV (`SUM(pgin_pv) WHERE imp_hour <= current hour`)
  - `pgin_uv_dth` BIGINT — current day inner-page UV (`COUNT(DISTINCT user_id) WHERE pgin_pv > 0 AND imp_hour <= current hour`)
  - `send_cnt_1h` BIGINT — last 1 hour send count (`SUM(send_cnt) WHERE imp_hour = current hour`)
  - `send_uv_1h` BIGINT — last 1 hour send UV
  - `panel_exp_cnt_1h` BIGINT — last 1 hour panel exposure count
  - `panel_exp_uv_1h` BIGINT — last 1 hour panel exposure UV
  - `pgin_pv_1h` BIGINT — last 1 hour inner-page PV
  - `pgin_uv_1h` BIGINT — last 1 hour inner-page UV

- Simplified explanation: For each `imp_hour` + `pos_desc` combination, compute the current day cumulative (dth) and current hour (1h) aggregation metrics
- If the target table does not exist, first create the table, then write the data
- Use Presto/Trino SQL syntax; do not use Hive/Spark SQL dialects

**Environment and Execution Notes**:
- Presto is running, connected via the Hive catalog
- Execute SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- After writing `result.sql`, you must execute it yourself to verify that it runs successfully and produces correct data

INSERT OVERWRITE TABLE internal_platform_db.ads_news_plugin_ai_assistant_hourly_report_prestosql_006
SELECT
  h.imp_hour,
  h.pos_desc AS scene,
  h.send_cnt_dth,
  h.send_uv_dth,
  h.panel_exp_cnt_dth,
  h.panel_exp_uv_dth,
  h.pgin_pv_dth,
  h.pgin_uv_dth,
  h.send_cnt_1h,
  h.send_uv_1h,
  h.panel_exp_cnt_1h,
  h.panel_exp_uv_1h,
  h.pgin_pv_1h,
  h.pgin_uv_1h
FROM (
  SELECT
    t1.imp_hour,
    t1.pos_desc,
    t1.send_cnt AS send_cnt_dth,
    t1.send_uv AS send_uv_dth,
    t1.panel_exp_cnt AS panel_exp_cnt_dth,
    t1.panel_exp_uv AS panel_exp_uv_dth,
    t1.pgin_pv AS pgin_pv_dth,
    t1.pgin_uv AS pgin_uv_dth,
    t2.send_cnt AS send_cnt_1h,
    t2.send_uv AS send_uv_1h,
    t2.panel_exp_cnt AS panel_exp_cnt_1h,
    t2.panel_exp_uv AS panel_exp_uv_1h,
    t2.pgin_pv AS pgin_pv_1h,
    t2.pgin_uv AS pgin_uv_1h
  FROM (
    SELECT
      a.imp_hour,
      a.pos_desc,
      SUM(b.send_cnt) AS send_cnt,
      COUNT(DISTINCT b.user_id) AS send_uv,
      SUM(b.panel_exp_cnt) AS panel_exp_cnt,
      COUNT(DISTINCT CASE WHEN b.panel_exp_cnt > 0 THEN b.user_id END) AS panel_exp_uv,
      SUM(b.pgin_pv) AS pgin_pv,
      COUNT(DISTINCT CASE WHEN b.pgin_pv > 0 THEN b.user_id END) AS pgin_uv
    FROM (SELECT DISTINCT imp_hour, pos_desc FROM internal_platform_db.dwm_news_plugin_ai_assistant_send_process_flow_hi_prestosql_006) a
    JOIN internal_platform_db.dwm_news_plugin_ai_assistant_send_process_flow_hi_prestosql_006 b
      ON a.pos_desc = b.pos_desc AND b.imp_hour <= a.imp_hour
    GROUP BY a.imp_hour, a.pos_desc
  ) t1
  JOIN (
    SELECT
      imp_hour,
      pos_desc,
      SUM(send_cnt) AS send_cnt,
      COUNT(DISTINCT user_id) AS send_uv,
      SUM(panel_exp_cnt) AS panel_exp_cnt,
      COUNT(DISTINCT CASE WHEN panel_exp_cnt > 0 THEN user_id END) AS panel_exp_uv,
      SUM(pgin_pv) AS pgin_pv,
      COUNT(DISTINCT CASE WHEN pgin_pv > 0 THEN user_id END) AS pgin_uv
    FROM internal_platform_db.dwm_news_plugin_ai_assistant_send_process_flow_hi_prestosql_006
    GROUP BY imp_hour, pos_desc
  ) t2 ON t1.imp_hour = t2.imp_hour AND t1.pos_desc = t2.pos_desc
) h


APK Threat Scan Instance GPU Card-Hour 5-Minute Window Statistics

Prompt:
## Prompt
**Task Objective**: Compute the GPU card-hour consumption of APK scan instances, aggregated by 5-minute time windows, joining with Pod mapping and task instance GPU configuration information, and write the results to the output table.

**Input Tables**:
- `internal_platform_db.t_gpu_monitor_parsed_prestosql_007` (GPU monitoring data table)
  - `container` STRING — container name
  - `pod_name` STRING — Pod name
  - `pkg_time` STRING — reporting time (epoch second string)
  - `gpu_name` STRING — GPU model
  - `metric` STRING — metric name
  - `value` STRING — metric value
  - `dt` STRING — partition field (format `'2026060800'`)

- `internal_platform_db.dwd_scan_instance_podname_prestosql_007` (Pod-to-scan-instance mapping table)
  - `dt` STRING — partition field
  - `instance_uuid` STRING — instance unique identifier
  - `pod_name` STRING — Pod name
  - `pod_phase` STRING — Pod phase
  - `namespace` STRING — namespace

- `internal_platform_db.dwd_scan_task_instance_prestosql_007` (task instance GPU configuration table 1)
  - `databus_imp_date` STRING — partition field
  - `instance_uuid` STRING — instance unique identifier
  - `host_gpu_num` DOUBLE — host GPU card count
  - `host_num` DOUBLE — host count
  - `last_modify` DOUBLE — last modification timestamp
  - `gpu_name` STRING — GPU model

- `internal_platform_db.scan_task_instance_prestosql_007` (scan task instance GPU configuration table 2)
  - `databus_imp_date` STRING — partition field
  - `instance_uuid` STRING — instance unique identifier
  - `host_gpu_num` DOUBLE — host GPU card count
  - `host_num` DOUBLE — host count
  - `last_modify` DOUBLE — last modification timestamp
  - `gpu_name` STRING — GPU model
  - `scan_type` STRING — scan type

**Computation Logic**:
1. Filter specified metrics from the GPU monitoring data, and compute runtime per Pod in 5-minute time windows
2. Join with the Pod-to-instance mapping to aggregate the GPU runtime and Pod count per instance per 5-minute window
3. Retrieve the latest GPU configuration information for each task instance
4. Compute the GPU card-hours (GPU-hour) per instance per 5-minute window
5. The specific time window bucketing method, join conditions, aggregation logic, and GPU-hour computation formula must be determined based on the table structures and business semantics

**Output Requirements**:
- Target table: `internal_platform_db.t_scan_instance_gpu_time_stats_cand_prestosql_007`
- Output fields and order: `instance_uuid` STRING, `time_5min` BIGINT, `host_gpu_num` DOUBLE, `sum_run_time_m` DOUBLE, `gpu_hour` DOUBLE, `gpu_name` STRING, `pod_count` BIGINT, `host_num` DOUBLE
- If the target table does not exist, first create the table, then write the data
- Use Presto/Trino SQL syntax; do not use Hive/Spark SQL dialects

**Environment and Execution Notes**:
- Presto is running, connected via the Hive catalog
- Execute SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- After writing `result.sql`, you must execute it yourself to verify that it runs successfully and produces correct data

INSERT INTO internal_platform_db.t_scan_instance_gpu_time_stats_prestosql_007
WITH
-- Step 1: From GPU monitoring data, extract pod run records with minute-level dedup
pod_run_minutes AS (
    SELECT
        pod_name,
        gpu_name,
        FLOOR(CAST(pkg_time AS BIGINT) / 60) * 60 AS minute_timestamp,
        FLOOR(CAST(pkg_time AS BIGINT) / 300) * 300 AS time_5min
    FROM internal_platform_db.t_gpu_monitor_parsed_prestosql_007
    WHERE dt = '2026060800'
        AND metric IN ('k8s_container_vgpu_gpu_mem_usage', 'k8s_dcgm_fi_dev_fb_util')
    GROUP BY pod_name, gpu_name, FLOOR(CAST(pkg_time AS BIGINT) / 60) * 60, FLOOR(CAST(pkg_time AS BIGINT) / 300) * 300
),

-- Step 2: Aggregate run minutes per pod per 5-minute window
pod_run_time AS (
    SELECT
        pod_name,
        MAX(gpu_name) AS gpu_name,
        time_5min,
        CAST(COUNT(DISTINCT minute_timestamp) AS DOUBLE) AS run_time_m
    FROM pod_run_minutes
    GROUP BY pod_name, time_5min
),

-- Step 3: Join pod-to-instance mapping, aggregate per instance per window
instance_run_time AS (
    SELECT
        p.time_5min,
        m.instance_uuid,
        MAX(p.gpu_name) AS gpu_name,
        CAST(SUM(p.run_time_m) AS DOUBLE) AS sum_run_time_m,
        COUNT(DISTINCT m.pod_name) AS pod_count
    FROM pod_run_time p
    INNER JOIN internal_platform_db.dwd_scan_instance_podname_prestosql_007 m
        ON p.pod_name = m.pod_name
        AND m.dt = '2026060800'
    GROUP BY p.time_5min, m.instance_uuid
),

-- Step 4: Get latest GPU config per instance from dual-table UNION ALL + ROW_NUMBER dedup
latest_task_config AS (
    SELECT
        instance_uuid,
        CAST(host_gpu_num AS DOUBLE) AS host_gpu_num,
        CAST(host_num AS DOUBLE) AS host_num,
        gpu_name
    FROM (
        SELECT
            instance_uuid,
            host_gpu_num,
            host_num,
            gpu_name,
            last_modify,
            ROW_NUMBER() OVER (PARTITION BY instance_uuid ORDER BY last_modify DESC) AS rn
        FROM (
            SELECT
                instance_uuid,
                host_gpu_num,
                host_num,
                gpu_name,
                last_modify
            FROM internal_platform_db.dwd_scan_task_instance_prestosql_007
            WHERE databus_imp_date = (
                SELECT MAX(databus_imp_date)
                FROM internal_platform_db.dwd_scan_task_instance_prestosql_007
            )

            UNION ALL

            SELECT
                instance_uuid,
                host_gpu_num,
                host_num,
                gpu_name,
                last_modify
            FROM internal_platform_db.scan_task_instance_prestosql_007
            WHERE databus_imp_date = (
                SELECT MAX(databus_imp_date)
                FROM internal_platform_db.scan_task_instance_prestosql_007
            )
        ) combined
    ) ranked
    WHERE rn = 1
)

-- Step 5: Join instance run time with GPU config, compute GPU-hour
SELECT
    i.instance_uuid,
    i.time_5min,
    t.host_gpu_num,
    i.sum_run_time_m,
    CASE
        WHEN t.host_gpu_num IS NOT NULL AND i.sum_run_time_m IS NOT NULL
        THEN t.host_gpu_num * i.sum_run_time_m / 60.0
        ELSE NULL
    END AS gpu_hour,
    i.gpu_name,
    i.pod_count,
    t.host_num
FROM instance_run_time i
LEFT JOIN latest_task_config t
    ON i.instance_uuid = t.instance_uuid
;


Report WUID Detail Filtering

Prompt:
## Prompt
**Task Objective**: From the ad report WUID detail wide table, filter target ad delivery records based on multi-dimensional filter conditions, extract key fields, and write the results to the output table.

**Input Table**:
- `internal_platform_db.t_report_wuid_detail_d_prestosql_008` (report WUID detail table)
  - `wuid` STRING — user identifier
  - `product_id` STRING — product ID
  - `adgroup_id` BIGINT — ad group ID
  - `action_time` BIGINT — action time
  - `crm_id` BIGINT — CRM ID
  - `creative_id` BIGINT — creative ID
  - `ocpx_conversion_cnt` BIGINT — oCpx conversion count
  - `optimization_goal` INT — optimization goal
  - `second_optimization_goal` INT — second-level optimization goal
  - `roi_goal` INT — ROI goal
  - `product_type` INT — product type
  - `site_set` INT — site set
  - `crm_advertiser_industry_id` BIGINT — CRM advertiser industry ID
  - `label` INT — label
  - `partition_time` BIGINT — partition time
  - `ds` BIGINT — partition field

**Filter Conditions**:
- `partition_time = 20260608`
- `ocpx_conversion_cnt = 0`
- `optimization_goal IN (105, 603)`
- `second_optimization_goal = 0`
- `roi_goal = 7`
- `product_type = 46`
- `site_set = 21`
- `product_id IS NOT NULL`
- `crm_advertiser_industry_id != 0`
- `creative_id != 0`

**Output Requirements**:
- Target table: `internal_platform_db.sdk_sample_pay_neg_mini_cand_prestosql_008`
- Output fields and order: `wuid` STRING, `product_id` STRING, `adgroup_id` BIGINT, `action_time` BIGINT, `crm_id` BIGINT, `creative_id` BIGINT, `label` INT, `product_type` INT, `optimization_goal` INT, `roi_goal` INT, `partition_time` BIGINT
- If the target table does not exist, first create the table, then write the data
- Use Presto/Trino SQL syntax; do not use Hive/Spark SQL dialects

**Environment and Execution Notes**:
- Presto is running, connected via the Hive catalog
- Execute SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- After writing `result.sql`, you must execute it yourself to verify that it runs successfully and produces correct data

INSERT OVERWRITE TABLE internal_platform_db.sdk_sample_pay_neg_mini_prestosql_008
SELECT
  wuid,
  product_id,
  adgroup_id,
  action_time,
  crm_id,
  creative_id,
  label,
  product_type,
  optimization_goal,
  roi_goal,
  partition_time
FROM internal_platform_db.t_report_wuid_detail_d_prestosql_008
WHERE partition_time = 20260608
  AND ocpx_conversion_cnt = 0
  AND optimization_goal IN (105, 603)
  AND second_optimization_goal = 0
  AND roi_goal = 7
  AND product_type = 46
  AND site_set = 21
  AND product_id IS NOT NULL
  AND crm_advertiser_industry_id != 0
  AND creative_id != 0


Data Pipeline Killed Instance Analysis

Prompt:
## Prompt
Join pipeline span info and resource info tables to produce killed instance detail table. Specific filtering conditions and field selection need to be determined based on table structure.

**输入表**：
- `internal_platform_db.t_pipeline_span_info_prestosql_009`（Pipeline span信息表）
  - `databus_imp_date` STRING — 日期分区
  - `trace_id` STRING — 链路标识
  - `span_name` STRING — span名称
  - `start_time` STRING — 开始时间(epoch毫秒)
  - `end_time` STRING — 结束时间(epoch毫秒)
  - `status_code` INT — 状态码
  - `project_id` STRING — 项目ID
  - `task_id` STRING — 任务ID
  - `compute_type` STRING — 计算类型

- `internal_platform_db.t_pipeline_resource_info_prestosql_009`（Pipeline资源信息表）
  - `databus_imp_date` STRING — 日期分区
  - `trace_id` STRING — 链路标识
  - `compute_type` STRING — 计算类型
  - `resource_id` STRING — 资源ID
  - `is_dedicated` STRING — 是否独占
  - `cpu_cores` INT — CPU核数

**输出要求**：
- 目标表: `internal_platform_db.t_pipeline_killed_instance_detail_cand_prestosql_009`
- 具体过滤条件、字段选择、计算逻辑需根据表结构和数据特征自行分析确定
- 如果目标表不存在，请先建表再写入数据
- 请使用Presto/Trino SQL语法，不要使用Hive/Spark SQL方言

**环境与执行说明**：
- Presto已启动，通过Hive catalog连接
- 执行SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- 写出result.sql后，必须自己执行验证它能成功运行并产出正确数据

INSERT INTO internal_platform_db.t_pipeline_killed_instance_detail_prestosql_009
WITH base_trace AS (
    SELECT trace_id
    FROM internal_platform_db.t_pipeline_span_info_prestosql_009
    WHERE databus_imp_date = '20260608'
      AND span_name IN ('pipeline.execute', 'pipeline.killed')
    GROUP BY trace_id
    HAVING
        COUNT(CASE WHEN span_name = 'pipeline.killed' THEN 1 END) > 0
        AND
        COUNT(CASE WHEN span_name = 'pipeline.execute' THEN 1 END) = 0
),
combined_spans AS (
  SELECT
      trace_id,
      span_name,
      start_time,
      end_time,
      project_id,
      task_id,
      compute_type,
      status_code
  FROM internal_platform_db.t_pipeline_span_info_prestosql_009
  WHERE databus_imp_date = '20260608'
    AND trace_id IN (SELECT trace_id FROM base_trace)
    AND span_name IN ('pipeline.killed', 'pipeline.start', 'task.run', 'task.compile', 'resource.request')

  UNION ALL

  SELECT
      trace_id,
      'pipeline.execute' AS span_name,
      MAX(CASE WHEN span_name = 'pipeline.start' THEN start_time END) AS start_time,
      MAX(CASE WHEN span_name = 'pipeline.killed' THEN end_time END) AS end_time,
      MAX(CASE WHEN span_name = 'pipeline.killed' THEN project_id END) AS project_id,
      MAX(CASE WHEN span_name = 'pipeline.killed' THEN task_id END) AS task_id,
      MAX(CASE WHEN span_name = 'pipeline.killed' THEN compute_type END) AS compute_type,
      2 AS status_code
  FROM internal_platform_db.t_pipeline_span_info_prestosql_009
  WHERE databus_imp_date = '20260608'
    AND trace_id IN (SELECT trace_id FROM base_trace)
    AND span_name IN ('pipeline.start', 'pipeline.killed')
  GROUP BY trace_id
),
base_data_time_fixed AS (
  SELECT
      trace_id,
      span_name,
      CASE
          WHEN span_name = 'pipeline.killed'
            THEN MIN(CASE WHEN span_name IN ('task.run', 'pipeline.killed') THEN start_time END)
                    OVER(PARTITION BY trace_id)
          ELSE start_time
      END AS start_time,
      end_time,
      project_id,
      task_id,
      compute_type,
      status_code
  FROM combined_spans
),
base_data AS (
  SELECT
      trace_id,
      span_name,
      start_time,
      end_time,
      project_id,
      task_id,
      compute_type,
      status_code,
      from_unixtime(CAST(start_time AS BIGINT) / 1000) AS start_date,
      from_unixtime(CAST(end_time AS BIGINT) / 1000) AS end_date,
      date_diff('day', CAST(from_unixtime(CAST(start_time AS BIGINT) / 1000) AS TIMESTAMP), CAST(from_unixtime(CAST(end_time AS BIGINT) / 1000) AS TIMESTAMP)) AS diff_days
  FROM base_data_time_fixed
),
pos_series AS (
    SELECT 0 AS pos UNION ALL SELECT 1 AS pos UNION ALL SELECT 2 AS pos UNION ALL SELECT 3 AS pos
),
daily_split_spans AS (
    SELECT
        trace_id,
        span_name,
        project_id,
        task_id,
        compute_type,
        status_code,
        start_date,
        end_date,
        diff_days,
        CAST(date_add('day', s.pos, CAST(b.start_date AS TIMESTAMP)) AS VARCHAR) AS calc_date,
        CASE WHEN s.pos = 0 THEN b.start_time
             ELSE CAST(CAST(to_unixtime(CAST(date_add('day', s.pos, CAST(b.start_date AS TIMESTAMP)) AS TIMESTAMP)) AS BIGINT) * 1000 AS VARCHAR)
        END AS start_time,
        CASE WHEN s.pos = b.diff_days THEN b.end_time
             ELSE CAST(CAST(to_unixtime(CAST(date_add('day', s.pos + 1, CAST(b.start_date AS TIMESTAMP)) AS TIMESTAMP)) AS BIGINT) * 1000 - 1 AS VARCHAR)
        END AS end_time,
        b.start_time AS span_start_time,
        b.end_time AS span_end_time
    FROM base_data b
    INNER JOIN pos_series s ON s.pos <= b.diff_days
),
trace_time_metrics AS (
    SELECT
        trace_id,
        calc_date,
        MAX(project_id) AS project_id,
        MAX(task_id) AS task_id,
        MAX(compute_type) AS compute_type,
        MAX(MAX(CASE WHEN span_name = 'pipeline.execute' THEN status_code END)) OVER(PARTITION BY trace_id) AS status_code,
        CAST(ROUND((MAX(CASE WHEN span_name = 'pipeline.execute' THEN CAST(end_time AS BIGINT) END) -
               MIN(CASE WHEN span_name = 'pipeline.execute' THEN CAST(start_time AS BIGINT) END)) / 1000.0) AS INT) AS instance_run_time,
        CAST(ROUND((MAX(CASE WHEN span_name IN ('task.run', 'task.compile', 'pipeline.killed') THEN CAST(end_time AS BIGINT) END) -
               MIN(CASE WHEN span_name IN ('task.run', 'task.compile', 'pipeline.killed') THEN CAST(start_time AS BIGINT) END)) / 1000.0) AS INT) AS code_run_time,
        CAST(ROUND((MAX(CASE WHEN span_name = 'resource.request' THEN CAST(end_time AS BIGINT) END) -
               MIN(CASE WHEN span_name = 'resource.request' THEN CAST(start_time AS BIGINT) END)) / 1000.0) AS INT) AS resource_wait_time
    FROM daily_split_spans
    GROUP BY trace_id, calc_date
)
SELECT
  t1.calc_date AS p_date,
  t1.trace_id,
  t1.project_id,
  t1.task_id,
  t1.compute_type,
  t1.status_code,
  t1.instance_run_time,
  t1.code_run_time,
  t1.resource_wait_time,
  t2.resource_id,
  CAST(t2.is_dedicated AS BOOLEAN) AS is_dedicated
FROM trace_time_metrics t1 LEFT JOIN (
  SELECT
    trace_id,
    MAX(resource_id) AS resource_id,
    MAX(is_dedicated) AS is_dedicated
  FROM internal_platform_db.t_pipeline_resource_info_prestosql_009
  WHERE databus_imp_date = '20260608'
  GROUP BY trace_id
) t2 ON t1.trace_id = t2.trace_id
;


IOC MTTD指标计算

Prompt:
## Prompt
**任务目标**：从API指标表和威胁情报IOC表中，通过JSON解析提取IOC值，与IOC表关联计算MTTD（平均检测时间）指标，写入输出表。

**输入表**：
- `internal_platform_db.t_app_ti_entity_api_metrics_prod_hi_prestosql_010`（API指标表）
  - `timestamp` BIGINT — 时间戳
  - `username` STRING — 用户名
  - `appid` BIGINT — 应用ID
  - `path` STRING — 路径
  - `request` STRING — 请求体(JSON)
  - `response` STRING — 响应体
  - `ds` BIGINT — 分区字段

- `internal_platform_db.t_sh_threat_intel_lab_breakingti_soc_endpoint_security_format_output_prod_prestosql_010`（威胁情报IOC表）
  - `ioctype` STRING — IOC类型
  - `ioc` STRING — IOC值
  - `port` STRING — 端口
  - `producer` STRING — 生产者
  - `stamp` STRING — 时间戳
  - `category` STRING — 分类
  - `family` STRING — 家族
  - `apt_org` STRING — APT组织
  - `weapon` STRING — 武器
  - `usefor` STRING — 用途
  - `ttps` STRING — TTPs
  - `confidence` INT — 置信度
  - `context` STRING — 上下文
  - `intelligence_investigation` STRING — 情报调查
  - `match_subdomains` INT — 匹配子域名
  - `bdelete` INT — 删除标记
  - `deleted_time` STRING — 删除时间
  - `first_occur_time` STRING — 首次出现时间
  - `last_occur_time` STRING — 最后出现时间
  - `ds` BIGINT — 分区字段

**计算逻辑**：
1. 从API指标表提取: json_extract_scalar(request, '$.entity_value') AS ioc_value, 按ioc_value分组取MIN(timestamp) AS earliest_timestamp, 过滤ds=20260608
2. 从IOC表过滤: ioctype='DOMAIN' AND bdelete=0, 过滤ds=20260608
3. JOIN条件: ioc = ioc_value
4. time_diff_days = GREATEST(0, (unix_timestamp(first_occur_time) - earliest_timestamp) / 86400.0)

**输出要求**：
- 目标表: `internal_platform_db.t_app_breaking_ti_mttd_metric_cand_prestosql_010`
- 输出字段及顺序: `IOC` STRING, `IOCTYPE` STRING, `PORT` STRING, `first_occur_time` STRING, `earliest_timestamp` BIGINT, `family` STRING, `match_subdomains` INT, `time_diff_days` DOUBLE, `ds` BIGINT
- ds: 固定值 20260608
- 注意Presto中用json_extract_scalar代替get_json_object，用to_unixtime代替unix_timestamp（需配合FROM_UNIXTIME相关的转换）
- 如果目标表不存在，请先建表再写入数据
- 请使用Presto/Trino SQL语法，不要使用Hive/Spark SQL方言

**环境与执行说明**：
- Presto已启动，通过Hive catalog连接
- 执行SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- 写出result.sql后，必须自己执行验证它能成功运行并产出正确数据

INSERT OVERWRITE TABLE internal_platform_db.t_app_breaking_ti_mttd_metric_prestosql_010
WITH api_metrics AS (
  SELECT
    get_json_object(request, '$.entity_value') AS ioc_value,
    MIN(`timestamp`) AS earliest_timestamp
  FROM internal_platform_db.t_app_ti_entity_api_metrics_prod_hi_prestosql_010
  WHERE ds = 20260608
  GROUP BY get_json_object(request, '$.entity_value')
),
filtered_main AS (
  SELECT *
  FROM internal_platform_db.t_sh_threat_intel_lab_breakingti_soc_endpoint_security_format_output_prod_prestosql_010
  WHERE ioctype = 'DOMAIN' AND bdelete = 0 AND ds = 20260608
)
SELECT
  f.ioc AS IOC,
  f.ioctype AS IOCTYPE,
  f.port AS PORT,
  f.first_occur_time,
  a.earliest_timestamp,
  f.family,
  f.match_subdomains,
  GREATEST(0, (unix_timestamp(f.first_occur_time) - a.earliest_timestamp) / 86400.0) AS time_diff_days,
  20260608 AS ds
FROM filtered_main f
JOIN api_metrics a ON f.ioc = a.ioc_value


安全平台PG敏感接口2表UNION+聚合

Prompt:
## Prompt
**任务目标**：将两个安全平台PG敏感接口数据表合并，排除黑名单域名后，按日期、域名和接口路径聚合，将匹配规则名拼接为逗号分隔字符串，写入输出表。

**输入表**：（2个表结构相同）
- `internal_platform_db.internal_sec_radept_secpg_data_result2_prestosql_011`
- `internal_platform_db.internal_sec_radept_secpg_data_result4_prestosql_011`

各表字段:
  - `databus_imp_date` INT — 数据日期
  - `insert_time` STRING — 插入时间
  - `src_ip` STRING — 源IP
  - `employeename` STRING — 员工名
  - `http_host` STRING — 域名
  - `http_cgi` STRING — 接口路径
  - `http_param` STRING — 请求参数
  - `http_user_agent` STRING — 用户代理
  - `http_referer` STRING — 来源
  - `http_body` STRING — 请求体
  - `http_head` STRING — 请求头
  - `httpsrsp_body` STRING — 响应体
  - `httpsrsp_content_length` STRING — 响应内容长度
  - `https_method` STRING — HTTPS方法
  - `scan_group` STRING — 扫描组
  - `rule_name` STRING — 规则名
  - `match_string` STRING — 匹配字符串
  - `match_type` STRING — 匹配类型
  - `scan_comment` STRING — 扫描备注

**过滤条件**：
- `databus_imp_date = 20260608`
- `http_host NOT IN ('api.im-platform.example.com', 'mp.im-platform.example.com', 'open.im-platform.example.com', 'wx.im.example.com', 'wx2.im.example.com', 'wx8.im.example.com', 'web.im-platform.example.com', 'login.im-platform.example.com', 'long.open.im-platform.example.com', 'ext.im.example.com', 'proxy.svc.example.com', 'resolver.svc.example.com', 'cloud.provider.example.com', 'console.cloud.provider.example.com', 'csec.cloud.provider.example.com')`

**输出要求**：
- 目标表: `internal_platform_db.secpg_sensitive_interface_cand_prestosql_011`
- 输出字段及顺序: `databus_imp_date` INT, `http_host` STRING, `http_cgi` STRING, `con_con` STRING
- con_con: listagg(rule_name, ',') 或 array_join(array_agg(DISTINCT rule_name), ',') 聚合规则名
- 按 databus_imp_date, http_host, http_cgi 分组
- 如果目标表不存在，请先建表再写入数据
- 请使用Presto/Trino SQL语法，不要使用Hive/Spark SQL方言

**环境与执行说明**：
- Presto已启动，通过Hive catalog连接
- 执行SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- 写出result.sql后，必须自己执行验证它能成功运行并产出正确数据

INSERT OVERWRITE TABLE internal_platform_db.secpg_sensitive_interface_prestosql_011
SELECT
  databus_imp_date,
  http_host,
  http_cgi,
  concat_ws(',', collect_set(rule_name)) AS con_con
FROM (
  SELECT databus_imp_date, http_host, http_cgi, rule_name
  FROM internal_platform_db.internal_sec_radept_secpg_data_result2_prestosql_011
  WHERE databus_imp_date = 20260608
    AND http_host NOT IN ('api.im-platform.example.com', 'mp.im-platform.example.com', 'open.im-platform.example.com', 'wx.im.example.com', 'wx2.im.example.com', 'wx8.im.example.com', 'web.im-platform.example.com', 'login.im-platform.example.com', 'long.open.im-platform.example.com', 'ext.im.example.com', 'proxy.svc.example.com', 'resolver.svc.example.com', 'cloud.provider.example.com', 'console.cloud.provider.example.com', 'csec.cloud.provider.example.com')
  UNION ALL
  SELECT databus_imp_date, http_host, http_cgi, rule_name
  FROM internal_platform_db.internal_sec_radept_secpg_data_result4_prestosql_011
  WHERE databus_imp_date = 20260608
    AND http_host NOT IN ('api.im-platform.example.com', 'mp.im-platform.example.com', 'open.im-platform.example.com', 'wx.im.example.com', 'wx2.im.example.com', 'wx8.im.example.com', 'web.im-platform.example.com', 'login.im-platform.example.com', 'long.open.im-platform.example.com', 'ext.im.example.com', 'proxy.svc.example.com', 'resolver.svc.example.com', 'cloud.provider.example.com', 'console.cloud.provider.example.com', 'csec.cloud.provider.example.com')
) combined
GROUP BY databus_imp_date, http_host, http_cgi


Data Quality Check Pipeline Instance GPU Card-Hour Analysis

Prompt:
## Prompt
**Task Objective**: Analyze the runtime of data quality check pipeline instances. For some abnormally terminated instances, their completion records need to be backfilled. Compute the runtime duration of each instance per date shard, and combined with GPU monitoring data, compute the GPU card-hour consumption, ultimately outputting a detail table.

**Business Background**:
The data quality check pipeline produces various span records, including check.start, check.completed, check.aborted, data.scan, rule.evaluate, resource.allocate, etc. Some instances only record check.aborted without check.completed. For these instances, a synthetic check.completed record must be constructed based on their start and aborted times to correctly compute the runtime duration.

GPU monitoring data is collected in 5-minute windows and must be mapped to instances via Pod names. Combined with the GPU count from the task configuration, the card-hours are computed (gpu_hour = host_gpu_num * total_run_minutes / 60.0).

**Input Tables**:
- `internal_platform_db.t_quality_check_span_prestosql_012` (quality check span table)
  - `databus_imp_date` STRING — data date
  - `trace_id` STRING — trace ID
  - `span_name` STRING — span name
  - `start_time` STRING — start time (epoch milliseconds)
  - `end_time` STRING — end time (epoch milliseconds)
  - `status_code` INT — status code
  - `project_id` STRING — project ID
  - `task_id` STRING — task ID
  - `check_type` STRING — check type

- `internal_platform_db.t_quality_gpu_monitor_prestosql_012` (GPU monitoring table)
  - `pod_name` STRING — Pod name
  - `pkg_time` STRING — collection time (epoch seconds)
  - `gpu_name` STRING — GPU model
  - `metric` STRING — monitoring metric
  - `value` STRING — metric value
  - `dt` STRING — date partition

- `internal_platform_db.dwd_quality_podname_prestosql_012` (Pod-to-instance mapping table)
  - `dt` STRING — date partition
  - `instance_uuid` STRING — instance UUID
  - `pod_name` STRING — Pod name
  - `pod_phase` STRING — Pod phase

- `internal_platform_db.dwd_quality_task_config_prestosql_012` (task GPU configuration table 1)
  - `databus_imp_date` STRING — data date
  - `instance_uuid` STRING — instance UUID
  - `host_gpu_num` DOUBLE — GPU count
  - `host_num` DOUBLE — host count
  - `last_modify` DOUBLE — last modification time
  - `gpu_name` STRING — GPU model
  - `resource_id` STRING — resource ID
  - `is_dedicated` STRING — whether dedicated

- `internal_platform_db.quality_task_config_prestosql_012` (task GPU configuration table 2)
  - `databus_imp_date` STRING — data date
  - `instance_uuid` STRING — instance UUID
  - `host_gpu_num` DOUBLE — GPU count
  - `host_num` DOUBLE — host count
  - `last_modify` DOUBLE — last modification time
  - `gpu_name` STRING — GPU model
  - `resource_id` STRING — resource ID
  - `is_dedicated` STRING — whether dedicated
  - `scan_type` STRING — scan type

**Key Logic Notes**:
1. Identify trace_ids that have only check.aborted without check.completed, and synthesize a check.completed record for them
2. Spans running across days must be split by day, generating one record per day
3. GPU monitoring data must be deduplicated by 5-minute windows to compute running minutes, and mapped to instances via Pod mapping
4. The two GPU configuration tables must be combined with UNION ALL, then use ROW_NUMBER to take the latest configuration per instance
5. gpu_hour = host_gpu_num * total_run_minutes / 60.0

**Output Requirements**:
- Target table: `internal_platform_db.t_quality_check_gpu_instance_detail_cand_prestosql_012`
- Output fields: `p_date` STRING, `trace_id` STRING, `project_id` STRING, `task_id` STRING, `check_type` STRING, `status_code` INT, `instance_run_time` INT, `code_run_time` INT, `gpu_hour` DOUBLE, `resource_id` STRING, `is_dedicated` BOOLEAN
- If the target table does not exist, first create the table, then write the data
- Use Presto/Trino SQL syntax; do not use Hive/Spark SQL dialects

**Environment and Execution Notes**:
- Presto is running, connected via the Hive catalog
- Execute SQL: `presto-cli --catalog hive --schema internal_platform_db -f /tmp_workspace/result.sql`
- After writing `result.sql`, you must execute it yourself to verify that it runs successfully and produces correct data

INSERT INTO internal_platform_db.t_quality_check_gpu_instance_detail_prestosql_012
WITH base_trace AS (
    -- Step 1: Find trace_ids with check.aborted but NOT check.completed (HAVING inverted condition)
    SELECT trace_id
    FROM internal_platform_db.t_quality_check_span_prestosql_012
    WHERE databus_imp_date >= '2026060600'
      AND databus_imp_date <= '2026060800'
      AND span_name IN ('check.aborted', 'check.completed')
    GROUP BY trace_id
    HAVING COUNT(CASE WHEN span_name = 'check.aborted' THEN 1 END) > 0
       AND COUNT(CASE WHEN span_name = 'check.completed' THEN 1 END) = 0
),
combined_spans AS (
    -- Step 2: All original spans for ALL traces + synthetic check.completed for aborted-only traces
    SELECT
        trace_id,
        span_name,
        start_time,
        end_time,
        status_code,
        project_id,
        task_id,
        check_type
    FROM internal_platform_db.t_quality_check_span_prestosql_012
    WHERE databus_imp_date >= '2026060600'
      AND databus_imp_date <= '2026060800'
      AND span_name IN ('check.aborted', 'check.start', 'check.completed', 'data.scan', 'rule.evaluate', 'resource.allocate')

    UNION ALL

    SELECT
        trace_id,
        'check.completed' AS span_name,
        MAX(CASE WHEN span_name = 'check.start' THEN start_time END) AS start_time,
        MAX(CASE WHEN span_name = 'check.aborted' THEN end_time END) AS end_time,
        2 AS status_code,
        MAX(CASE WHEN span_name = 'check.aborted' THEN project_id END) AS project_id,
        MAX(CASE WHEN span_name = 'check.aborted' THEN task_id END) AS task_id,
        MAX(CASE WHEN span_name = 'check.aborted' THEN check_type END) AS check_type
    FROM internal_platform_db.t_quality_check_span_prestosql_012
    WHERE databus_imp_date >= '2026060600'
      AND databus_imp_date <= '2026060800'
      AND trace_id IN (SELECT trace_id FROM base_trace)
      AND span_name IN ('check.start', 'check.aborted')
    GROUP BY trace_id
),
base_data_time_fixed AS (
    -- Step 3: Fix check.aborted start_time -> earliest of code-related spans
    SELECT
        trace_id,
        span_name,
        CASE
            WHEN span_name = 'check.aborted'
            THEN MIN(CASE WHEN span_name IN ('data.scan', 'rule.evaluate', 'check.aborted') THEN start_time END)
                    OVER(PARTITION BY trace_id)
            ELSE start_time
        END AS start_time,
        end_time,
        status_code,
        project_id,
        task_id,
        check_type
    FROM combined_spans
),
base_data AS (
    -- Step 4: Convert timestamps, compute diff_days for cross-day splitting
    SELECT
        trace_id,
        span_name,
        start_time,
        end_time,
        status_code,
        project_id,
        task_id,
        check_type,
        from_unixtime(CAST(start_time AS BIGINT) / 1000) AS start_date,
        from_unixtime(CAST(end_time AS BIGINT) / 1000) AS end_date,
        date_diff('day', from_unixtime(CAST(start_time AS BIGINT) / 1000),
                 from_unixtime(CAST(end_time AS BIGINT) / 1000)) AS diff_days,
        CAST(CAST(start_time AS BIGINT) / 86400000 AS BIGINT) * 86400000 AS start_day_midnight_ms
    FROM base_data_time_fixed
),
pos_series AS (
    -- Step 5: Position series for cross-day expansion
    SELECT 0 AS pos UNION ALL SELECT 1 UNION ALL SELECT 2 UNION ALL SELECT 3
),
daily_split_spans AS (
    -- Step 6: INNER JOIN with pos_series, compute boundary timestamps per day
    SELECT
        trace_id,
        span_name,
        project_id,
        task_id,
        check_type,
        status_code,
        start_date,
        end_date,
        diff_days,
        date_add('day', s.pos, start_date) AS calc_date,
        CASE WHEN s.pos = 0 THEN start_time
             ELSE CAST(start_day_midnight_ms + s.pos * 86400000 AS VARCHAR)
        END AS split_start_time,
        CASE WHEN s.pos = diff_days THEN end_time
             ELSE CAST(start_day_midnight_ms + (s.pos + 1) * 86400000 - 1 AS VARCHAR)
        END AS split_end_time,
        start_time AS span_start_time,
        end_time AS span_end_time
    FROM base_data b
    INNER JOIN pos_series s ON s.pos <= b.diff_days
),
span_metrics AS (
    -- Step 7: GROUP BY trace_id, calc_date -> compute instance_run_time, code_run_time, status_code
    SELECT
        trace_id,
        calc_date,
        MAX(project_id) AS project_id,
        MAX(task_id) AS task_id,
        MAX(check_type) AS check_type,
        MAX(MAX(CASE WHEN span_name = 'check.completed' THEN status_code END))
            OVER(PARTITION BY trace_id) AS status_code,
        CAST(ROUND(
            (MAX(CASE WHEN span_name = 'check.completed' THEN CAST(split_end_time AS BIGINT) END) -
             MIN(CASE WHEN span_name = 'check.completed' THEN CAST(split_start_time AS BIGINT) END)) / 1000.0
        ) AS INT) AS instance_run_time,
        CAST(ROUND(
            (MAX(CASE WHEN span_name IN ('data.scan', 'rule.evaluate', 'check.aborted') THEN CAST(split_end_time AS BIGINT) END) -
             MIN(CASE WHEN span_name IN ('data.scan', 'rule.evaluate', 'check.aborted') THEN CAST(split_start_time AS BIGINT) END)) / 1000.0
        ) AS INT) AS code_run_time
    FROM daily_split_spans
    GROUP BY trace_id, calc_date
),
gpu_stats AS (
    -- Step 8: FLOOR 5-min window bucketing + pod mapping + ROW_NUMBER config dedup + gpu_hour
    SELECT
        ig.instance_uuid,
        lc.host_gpu_num * ig.total_run_time_m / 60.0 AS gpu_hour,
        ig.gpu_name,
        lc.resource_id,
        CASE WHEN lc.is_dedicated = 'true' THEN true ELSE false END AS is_dedicated
    FROM (
        -- Aggregate GPU run time per instance
        SELECT
            m.instance_uuid,
            MAX(p.gpu_name) AS gpu_name,
            SUM(p.run_time_m) AS total_run_time_m
        FROM (
            -- pod_run_time: count distinct minutes per (pod_name, time_5min)
            SELECT
                pod_name,
                MAX(gpu_name) AS gpu_name,
                time_5min,
                CAST(COUNT(DISTINCT minute_timestamp) AS DOUBLE) AS run_time_m
            FROM (
                -- pod_run_minutes: FLOOR bucketing dedup
                SELECT
                    pod_name,
                    gpu_name,
                    FLOOR(CAST(pkg_time AS BIGINT) / 60) * 60 AS minute_timestamp,
                    FLOOR(CAST(pkg_time AS BIGINT) / 300) * 300 AS time_5min
                FROM internal_platform_db.t_quality_gpu_monitor_prestosql_012
                WHERE metric IN ('k8s_container_vgpu_gpu_mem_usage', 'k8s_dcgm_fi_dev_fb_util')
                GROUP BY pod_name, gpu_name,
                         FLOOR(CAST(pkg_time AS BIGINT) / 60) * 60,
                         FLOOR(CAST(pkg_time AS BIGINT) / 300) * 300
            ) pod_run_minutes
            GROUP BY pod_name, time_5min
        ) p
        INNER JOIN internal_platform_db.dwd_quality_podname_prestosql_012 m
            ON p.pod_name = m.pod_name
        GROUP BY m.instance_uuid
    ) ig
    LEFT JOIN (
        -- latest_task_config: ROW_NUMBER dedup from UNION ALL of two config tables
        SELECT
            instance_uuid,
            host_gpu_num,
            resource_id,
            is_dedicated
        FROM (
            SELECT
                instance_uuid,
                host_gpu_num,
                resource_id,
                is_dedicated,
                ROW_NUMBER() OVER (PARTITION BY instance_uuid ORDER BY last_modify DESC) AS rn
            FROM (
                SELECT instance_uuid, host_gpu_num, last_modify, resource_id, is_dedicated
                FROM internal_platform_db.dwd_quality_task_config_prestosql_012
                WHERE databus_imp_date = (
                    SELECT MAX(databus_imp_date)
                    FROM internal_platform_db.dwd_quality_task_config_prestosql_012
                )
                UNION ALL
                SELECT instance_uuid, host_gpu_num, last_modify, resource_id, is_dedicated
                FROM internal_platform_db.quality_task_config_prestosql_012
                WHERE databus_imp_date = (
                    SELECT MAX(databus_imp_date)
                    FROM internal_platform_db.quality_task_config_prestosql_012
                )
            ) combined
        ) ranked
        WHERE rn = 1
    ) lc ON ig.instance_uuid = lc.instance_uuid
)
-- Final: JOIN span_metrics with gpu_stats
SELECT
    date_format(sm.calc_date, '%Y-%m-%d') AS p_date,
    sm.trace_id,
    sm.project_id,
    sm.task_id,
    sm.check_type,
    sm.status_code,
    sm.instance_run_time,
    sm.code_run_time,
    gs.gpu_hour,
    gs.resource_id,
    gs.is_dedicated
FROM span_metrics sm
LEFT JOIN gpu_stats gs ON sm.trace_id = gs.instance_uuid
;