import

Writes all input records to the specified table. Requires cluster administrator privileges.

Command properties

Syntax

Options

create=BOOL

When set to t, automatically creates the target table if it does not exist. This option is only available when the system property araqne.logdb.import_create_option is enabled. (Default: f)

_sk=STR

Field name for the partition subkey. Specifies the field from which to read the subkey value used to determine the partition when saving records. (Default: _sk)

Target

TABLE

Name of the target table to write records to.

Input fields

Error codes

Parsing errors

Runtime errors

N/A

Description

The import command writes all input records to the specified table and passes the input records to the next command. It uses the _time field value as the storage timestamp. If the _time field is missing or not a timestamp type, the current time is used.

In the 4.0 series starting with 4.0.2609.0, the _table, _id, _sk, _era, and _sto_class fields are treated as system-reserved fields managed directly by storage, so even if input records include these fields, they are excluded from the stored data. For example, if you save records retrieved from another table using import, the _table value carried in the original records is not stored as part of the user data, and instead the value based on the storage location is retrieved on lookup. The 5.0 series (through 5.0.2605.2) does not exclude these fields; if input records include them, their values are passed through to storage as ordinary field data.

When records are processed one at a time or in an ordinary batch, these fields are removed only from the data being stored, and the records passed on to the next command still retain the original fields. When records are processed as a vector batch, however, these fields are removed from the batch itself before it is passed to the next command, so referencing these fields after import — for example, table A | import B | fields _table — may return an empty value. (4.0 series, 4.0.2609.0 and later)

If the storage is in read-only mode or a write error occurs, the query is cancelled.

In a distributed environment, this command runs on the Control Node.

Examples

1. Write records to a table

   table duration=1h web_logs | import web_logs_backup
   

   Queries the last 1 hour of data from the web_logs table and writes it to the web_logs_backup table.

2. Save aggregated results to a table

   table duration=1d web_logs
   | stats count by method
   | import method_stats
   

   Aggregates 1 day of data from the web_logs table by HTTP method and saves it to the method_stats table.

3. Specify the partition subkey field

   table duration=1h web_logs | import _sk=host web_logs_partitioned
   

   Uses the value of the host field as the partition subkey and writes records to the web_logs_partitioned table.

Change history