Union of hot tier + s3 archive, restricted to the lookback window. Hot tier retains ~25 min; s3 covers everything older. UNION ALL plus the same window predicate on each side keeps the boundary handling simple — a row briefly visible in both sources would be double-counted, but the
(n: int, unit: str)
| 73 | # message_json (see `tools/tail_explain_cmds.py` for the un-wrapped shape). |
| 74 | # All extracts here go through that prefix. |
| 75 | def _source(n: int, unit: str) -> str: |
| 76 | """Union of hot tier + s3 archive, restricted to the lookback window. |
| 77 | |
| 78 | Hot tier retains ~25 min; s3 covers everything older. UNION ALL plus the |
| 79 | same window predicate on each side keeps the boundary handling simple — |
| 80 | a row briefly visible in both sources would be double-counted, but the |
| 81 | overlap is negligible vs. the cost of missing the s3 portion entirely. |
| 82 | """ |
| 83 | where = ( |
| 84 | f"dt >= now() - INTERVAL {n} {unit} AND JSONHas(raw, 'message_json', 'request')" |
| 85 | ) |
| 86 | return ( |
| 87 | "(\n" |
| 88 | f" SELECT raw, dt FROM {BS_HOT} WHERE {where}\n" |
| 89 | " UNION ALL\n" |
| 90 | f" SELECT raw, dt FROM {BS_S3} WHERE _row_type = 1 AND {where}\n" |
| 91 | ")" |
| 92 | ) |
| 93 | |
| 94 | |
| 95 | def _qs(source: str) -> dict[str, str]: |