awatch-rus/AWatch-rus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(1c): add read-only business event normalizer

Browse Source
This commit is contained in:
igor04091968
2026-05-22 22:00:49 +03:00
parent 61770c1658
commit f1d4bdfc2c
7 changed files with 576 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
clickhouse-1c/detections/build_entity_timeline.sql
+60
View File
@@ -17,6 +17,46 @@ FROM (
) AS src
WHERE src.ref_id NOT IN (SELECT ref_id FROM analytics_1c.entity_timeline);
INSERT INTO analytics_1c.entity_timeline
SELECT *
FROM (
SELECT
ts,
'document' AS entity_type,
document_id AS entity_id,
infobase,
user AS actor,
'business_events' AS source,
concat('business:', event_kind, ':', operation_type) AS event_type,
if(event_kind = 'posting', 'low', 'medium') AS severity,
greatest(10, toUInt32(round(amount))) AS score,
concat('business:', event_id) AS ref_id,
concat('Business event ', event_kind, ' ', document_type, ' №', document_number, ' amount=', toString(amount)) AS summary
FROM analytics_1c.business_events
WHERE document_id != ''
) AS src
WHERE src.ref_id NOT IN (SELECT ref_id FROM analytics_1c.entity_timeline);
INSERT INTO analytics_1c.entity_timeline
SELECT *
FROM (
SELECT
ts,
'counterparty' AS entity_type,
company_entity_key AS entity_id,
infobase,
user AS actor,
'business_events' AS source,
concat('company:', event_kind) AS event_type,
if(amount >= 50000, 'medium', 'low') AS severity,
greatest(10, toUInt32(round(amount))) AS score,
concat('business-company:', event_id) AS ref_id,
concat('Business activity ', counterparty, ' ', operation_type, ' amount=', toString(amount)) AS summary
FROM analytics_1c.business_events
WHERE company_entity_key != ''
) AS src
WHERE src.ref_id NOT IN (SELECT ref_id FROM analytics_1c.entity_timeline);
INSERT INTO analytics_1c.entity_timeline
SELECT *
FROM (
@@ -40,6 +80,26 @@ FROM (
) AS src
WHERE src.ref_id NOT IN (SELECT ref_id FROM analytics_1c.entity_timeline);
INSERT INTO analytics_1c.entity_timeline
SELECT *
FROM (
SELECT
ts,
if(document_id != '', 'document', 'counterparty') AS entity_type,
if(document_id != '', document_id, company_entity_key) AS entity_id,
infobase,
user AS actor,
'document_changes' AS source,
concat('change:', change_kind, ':', field_name) AS event_type,
if(risk_tag != '', 'high', 'medium') AS severity,
if(risk_tag != '', 70, 35) AS score,
concat('change:', change_id) AS ref_id,
concat('Change ', change_kind, ' field=', field_name, ' risk=', risk_tag) AS summary
FROM analytics_1c.document_change_events
WHERE (document_id != '' OR company_entity_key != '')
) AS src
WHERE src.ref_id NOT IN (SELECT ref_id FROM analytics_1c.entity_timeline);
INSERT INTO analytics_1c.entity_timeline
SELECT *
FROM (