我是 pig 新手,正在尝试对包含如下事件的文件执行一些基本分析:
1345477765 2012-08-20 08:49:24 servername 12.34.56.78 192.168.1.4 joebloggs ManageSystem Here's your message
我尝试如下加载文件:
logs = LOAD '/path/to/file' using PigStorage AS (loggedtime:long, serverdate:chararray, servertime:chararray, servername:chararray, externalip:chararray, internalip:chararray, username:chararray, systemtype:chararray, message:chararray);
当我说明日志时,一切看起来都很好:
Illustrate logs
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| logs | loggedtime:long | serverdate:chararray | servertime:chararray | servername:chararray | externalip:chararray | internalip:chararray | username:chararray | systemtype:chararray | message:chararray |
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| | 1345477765 | 2012-08-20 | 08:49:24 | servername | 12.34.56.78 | 192.168.1.4 | joebloggs | ManageSystem | Here's your message |
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
此外,当描述它们时,一切都如我所料:
logs: {loggedtime: long,serverdate: chararray,servertime: chararray,servername: chararray,externalip: chararray,internalip: chararray,username: chararray,systemtype: chararray,message: chararray}
但是,当我转储日志时,不包括记录时间。
dump logs;
(,2012-08-20,08:49:24,servername,12.34.56.78,192.168.1.4,joebloggs,ManageSystem,Here's your message)
大概因此,我的过滤器不返回任何事件:
specificlog = FILTER logs BY loggedtime == 1345477765;
希望我在这里遗漏了一些简单的东西。