Problem
For 1-second spatial ClickHouse queries using MIN / MAX with GROUP BY
(e.g., MAX(pkt_len) GROUP BY dstip), the asap-planner was generating the wrong configuration.
It was using MultipleMinMax, with:
- grouping: empty
- aggregated:
GROUP BY columns (like dstip)
- rollup: all other columns (
srcip, proto, etc.)
This setup treats all data as one big group with sub-groups inside it.
However, the query engine expects a simpler setup using MinMax:
- grouping:
GROUP BY columns (dstip)
- aggregated: empty
- rollup: empty
This means: compute one min/max per dstip every second.
Because of this mismatch:
- Queries failed or returned empty results (e.g., “no precomputed outputs”)
- Even when data ingestion was working correctly
- Since the planner config didn’t match what the engine expects
Note:
This issue only affected 1-second spatial queries.
Other queries (like multi-second or temporal queries) were already correct.
Problem
For 1-second spatial ClickHouse queries using
MIN/MAXwithGROUP BY(e.g.,
MAX(pkt_len) GROUP BY dstip), theasap-plannerwas generating the wrong configuration.It was using MultipleMinMax, with:
GROUP BYcolumns (likedstip)srcip,proto, etc.)This setup treats all data as one big group with sub-groups inside it.
However, the query engine expects a simpler setup using MinMax:
GROUP BYcolumns (dstip)This means: compute one min/max per
dstipevery second.Because of this mismatch:
Note:
This issue only affected 1-second spatial queries.
Other queries (like multi-second or temporal queries) were already correct.