type:"lvb"
and host:"{host}"
and streamname:"{streamname}"
| select
    histogram(cast(__TIMESTAMP__ as timestamp), interval 1 minute) as analytic_time,
    sum(case when http_code = 200 then 1 else 0 end) as http_code200,
    sum(case when http_code >= 400 and http_code < 500 then 1 else 0 end) as http_code4XX,
    sum(case when http_code >= 500 then 1 else 0 end) as http_code5XX
  group by analytic_time
  order by analytic_time
  limit 1000

type:"lvb"
| SELECT
    host,
    COUNT(*) AS req_total,
    COUNT_IF(http_code >= 400 AND http_code < 500) AS req_4xx,
    COUNT_IF(http_code >= 500 AND http_code < 600) AS req_5xx
  GROUP BY host
  ORDER BY req_5xx DESC, req_4xx DESC
  LIMIT 200

type:"lvb" and host:"{host}" and http_code=200 and streamname:"{streamname}" 
| select histogram( cast(__TIMESTAMP__ as timestamp),interval 1 minute) as analytic_time, 
avg(process_time)/1000.0 as process_time_sec 
group by analytic_time 
order by analytic_time 
limit 1000

type:"lvb" and host:"{host}" and http_code=200 and streamname:"{streamname}" 
| select histogram( cast(__TIMESTAMP__ as timestamp),interval 1 minute) as analytic_time,
 avg( if(rtt='-', NULL, cast(rtt as double)) )/1000.0 as avg_rtt_ms 
 group by analytic_time 
 order by analytic_time 
 limit 1000

type:"lvb"
| SELECT
    histogram(CAST(__TIMESTAMP__ AS timestamp), interval 1 minute) AS time,
    host,
    AVG(IF(lost_rate = '-', NULL, CAST(lost_rate AS double))) AS avg_lost_rate
GROUP BY time, host
ORDER BY time
LIMIT 1000

type:"lvb"
| select
    histogram(CAST(__TIMESTAMP__ AS timestamp), interval 1 minute) AS time,
    host,
    count(*) as req_count
group by time, host
order by time
limit 1000

type:"lvb"
| select
    histogram(CAST(__TIMESTAMP__ AS timestamp), interval 1 minute) AS time,
    host,
    case
        when url like '%.flv%' then 'flv'            
        when url like '%rtmp%' then 'rtmp'
        else 'other'
    end as protocol,
    count(*) as req_count
group by time, host, protocol
order by time
limit 1000

*
| SELECT
    histogram(CAST(__TIMESTAMP__ AS timestamp), interval {interval}) AS time,
    host,
    AVG(process_time) AS avg_process_time,
    MAX(process_time) AS max_process_time
  GROUP BY time, host
  ORDER BY time
  LIMIT 1000

type:"lvb"
| SELECT
    histogram(cast(__TIMESTAMP__ AS timestamp), interval 1 minute) AS time,
    host,
    SUM(IF(http_code >= 400 AND http_code < 600, 1, 0)) AS err_count,
    SUM(IF(http_code >= 400 AND http_code < 600, 1, 0)) * 1.0 / COUNT(*) AS err_rate
GROUP BY time, host
ORDER BY time
LIMIT 1000

type:"lvb"
AND host:"{host}"
AND streamname:"{streamname}"
AND client_ip:"{client_ip}"
| SELECT
    histogram(CAST(__TIMESTAMP__ AS timestamp), interval {interval}) AS time,
    client_ip,
    COUNT(*) AS req_count,
    ROUND(COUNT_IF(http_code = 200) * 100.0 / COUNT(*), 2) AS success_rate_pct,
    COUNT_IF(http_code >= 400 AND http_code < 500) AS err_4xx,
    COUNT_IF(http_code >= 500 AND http_code < 600) AS err_5xx,
    AVG(IF(rtt = '-', NULL, CAST(rtt AS DOUBLE))) / 1000.0 AS avg_rtt_ms,
    AVG(IF(lost_rate = '-', NULL, CAST(lost_rate AS DOUBLE))) AS avg_lost_rate
  GROUP BY time, client_ip
  ORDER BY time
  LIMIT 1000

*
| SELECT
    histogram(CAST(__TIMESTAMP__ AS timestamp), interval 1 minute) AS time,
    CONCAT(host, ' | ', streamname) AS host_stream,
    ROUND(SUM(size) * 8 / 60.0 / 1000, 2) AS bitrate_kbps
  GROUP BY time, host_stream
  ORDER BY time
  LIMIT 1000

*
| SELECT
    histogram(CAST(__TIMESTAMP__ AS timestamp), interval 1 minute) AS time,
    host,
    ROUND(SUM(size) * 8 / 60.0 / 1000 / 1000, 3) AS avg_bandwidth_mbps
  GROUP BY time, host
  ORDER BY time
  LIMIT 1000