CREATE TABLE IF NOT EXISTS analytics_1c.documents
(
    ts DateTime,
    infobase LowCardinality(String),
    organization String,
    department String,
    doc_type LowCardinality(String),
    doc_id String,
    doc_number String,
    author String,
    counterparty String,
    operation_type String,
    amount Decimal(18, 2),
    status LowCardinality(String),
    posted UInt8,
    source_file String
)
ENGINE = MergeTree
ORDER BY (infobase, ts, doc_type, doc_id);

CREATE TABLE IF NOT EXISTS analytics_1c.postings
(
    ts DateTime,
    infobase LowCardinality(String),
    registrar String,
    operation_type String,
    account_dt String,
    account_ct String,
    amount Decimal(18, 2),
    source_file String
)
ENGINE = MergeTree
ORDER BY (infobase, ts, registrar);

CREATE TABLE IF NOT EXISTS analytics_1c.business_events
(
    ts DateTime,
    event_id String,
    infobase LowCardinality(String),
    company_entity_key String,
    organization String,
    department String,
    document_id String,
    document_number String,
    document_type LowCardinality(String),
    registrar String,
    operation_type String,
    event_kind LowCardinality(String),
    user String,
    counterparty String,
    counterparty_inn String,
    debit_account String,
    credit_account String,
    amount Decimal(18, 2),
    currency LowCardinality(String),
    line_no UInt32,
    evidence_ref String,
    source_file String
)
ENGINE = MergeTree
ORDER BY (infobase, ts, document_id, line_no, event_id);

CREATE TABLE IF NOT EXISTS analytics_1c.document_change_events
(
    ts DateTime,
    change_id String,
    infobase LowCardinality(String),
    company_entity_key String,
    organization String,
    document_id String,
    document_number String,
    document_type LowCardinality(String),
    change_kind LowCardinality(String),
    field_name String,
    user String,
    before_value String,
    after_value String,
    risk_tag String,
    evidence_ref String,
    source_file String
)
ENGINE = MergeTree
ORDER BY (infobase, ts, document_id, change_id);

CREATE TABLE IF NOT EXISTS analytics_1c.companies
(
    ts DateTime,
    infobase LowCardinality(String),
    company_name String,
    organization String,
    owner_user String,
    base_id String,
    base_path String,
    status LowCardinality(String),
    db_size_bytes UInt64,
    reglog_size_bytes UInt64,
    active_locks UInt32,
    temp_db_present UInt8,
    scheduler_touched UInt8,
    activity_score Float32,
    source_file String
)
ENGINE = MergeTree
ORDER BY (infobase, ts);

CREATE TABLE IF NOT EXISTS analytics_1c.company_registry
(
    ts DateTime,
    source_file String,
    source_sheet LowCardinality(String),
    company_name String,
    company_key String,
    assignee_name String,
    registry_status LowCardinality(String),
    share_text String,
    key_contour UInt8,
    inn String,
    kpp String
)
ENGINE = MergeTree
ORDER BY (company_key, ts, source_sheet);

CREATE TABLE IF NOT EXISTS analytics_1c.reglog_events
(
    ts DateTime,
    infobase LowCardinality(String),
    user String,
    host String,
    app String,
    event_name String,
    level LowCardinality(String),
    duration_ms UInt32,
    message String,
    source_file String
)
ENGINE = MergeTree
ORDER BY (infobase, ts, user, event_name);

CREATE TABLE IF NOT EXISTS analytics_1c.audit_events
(
    ts DateTime,
    infobase LowCardinality(String),
    user String,
    object_type String,
    object_id String,
    action String,
    before_hash String,
    after_hash String,
    risk_tag String,
    source_file String
)
ENGINE = MergeTree
ORDER BY (infobase, ts, object_type, object_id);

CREATE TABLE IF NOT EXISTS analytics_1c.host_events
(
    ts DateTime,
    host String,
    cpu_pct Float32,
    ram_pct Float32,
    disk_free_gb Float32,
    disk_latency_ms Float32,
    smb_errors UInt32,
    rdp_sessions UInt32,
    backup_ok UInt8,
    source_file String
)
ENGINE = MergeTree
ORDER BY (host, ts);

CREATE TABLE IF NOT EXISTS analytics_1c.entity_timeline
(
    ts DateTime,
    entity_type LowCardinality(String),
    entity_id String,
    infobase LowCardinality(String),
    actor String,
    source LowCardinality(String),
    event_type String,
    severity LowCardinality(String),
    score UInt32,
    ref_id String,
    summary String
)
ENGINE = MergeTree
ORDER BY (entity_type, entity_id, ts);

CREATE TABLE IF NOT EXISTS analytics_1c.detections
(
    ts DateTime,
    detection_id String,
    infobase LowCardinality(String),
    rule_id String,
    rule_title String,
    entity_type LowCardinality(String),
    entity_id String,
    severity LowCardinality(String),
    score UInt32,
    summary String,
    status LowCardinality(String) DEFAULT 'open'
)
ENGINE = MergeTree
ORDER BY (severity, ts, rule_id, entity_type, entity_id);

CREATE TABLE IF NOT EXISTS analytics_1c.cases
(
    opened_at DateTime,
    case_id String,
    infobase LowCardinality(String),
    title String,
    severity LowCardinality(String),
    status LowCardinality(String),
    assignee String,
    detection_id String,
    entity_type String,
    entity_id String,
    summary String
)
ENGINE = MergeTree
ORDER BY (opened_at, case_id);