常用查询分析语句与告警设置 查询所有CODE比例 图表预览: 语句示例: plaintext SELECT remotehost AS "域名", Rate200 AS "200比例", Rate302 AS "302比例", Rate404 AS "404比例", Rate499 AS "499比例", Rate500 AS "500比例", Rate502 AS "502比例", Rate503 AS "503比例", Rate504 AS "504比例", countall AS "总请求数", code200, code302, code404, code499, code500, code502, code503, code504 FROM( SELECT remotehost, round( round(code200 1.0000 / countall, 4) 100, 2 ) AS Rate200, round( round(code302 1.0000 / countall, 4) 100, 2 ) AS Rate302, round( round(code404 1.0000 / countall, 4) 100, 2 ) AS Rate404, round( round(code499 1.0000 / countall, 4) 100, 2 ) AS Rate499, round( round(code500 1.0000 / countall, 4) 100, 2 ) AS Rate500, round( round(code502 1.0000 / countall, 4) 100, 2 ) AS Rate502, round( round(code503 1.0000 / countall, 4) 100, 2 ) AS Rate503, round( round(code504 1.0000 / countall, 4) 100, 2 ) AS Rate504, countall, code200, code302, code404, code499, code500, code502, code503, code504 FROM ( SELECT remotehost, countif( respcode'200' ) AS code200, countif( respcode'302' ) AS code302, countif( respcode'404' ) AS code404, countif( respcode'499' ) AS code499, countif( respcode'500' ) AS code500, countif( respcode'502' ) AS code502, countif( respcode'503' ) AS code503, countif( respcode'504' ) AS code504, COUNT() AS countall FROM log WHERE isattack 'false' GROUP BY remotehost ) ) WHERE countall > 10 ORDER BY Rate200 DESC LIMIT 5 说明 isattack 'false'表示仅统计访问日志; remotehost表示按照实际域名进行聚合; countall统计该时间段窗口内所有请求数; respcode'200'表示响应码为200的请求。 该查询执行语句执行以后,生成的图表包含以下字段:总请求数、2XX比例、3XX比例、4XX比例、5XX比例,分别表示域名选择时间范围内的总请求量和各类型响应状态码的占比。如果想要查询更多过滤字段,请参考WAF日志字段说明。