# Filter add-friend behavior from internal_platform_db.log_17047_query_engine_102 (HiveSQL)

## Prompt
Task Objective:
Perform cluster aggregation analysis on add-friend behavior logs to identify malicious clusters, and output statistical metrics for each cluster.

Input:
- `internal_platform_db.log_17047_query_engine_102` (add-friend behavior log table)

Processing Rules:
1. No joins, single-table processing, using UNION of two subqueries
2. Time filter: `day_` between 20260608–20260609, `hour_` between 2026060823–2026060900, `timestamp_` between 202606082320 and 202606090020
3. Branch 1 filter: `appname_ in ('app_hello_txt', 'app_add_contact')`, `uinregcountry_ in ('CN','HK','MO')`, `touinregcountry_='CN'`, `length(headmd5_)>0`, `commfrinum_=0`
4. Branch 2 filter: `appname_='app_contact_verify_ok'`, `uinregcountry_ in ('CN','HK','MO')`, `touinregcountry_='CN'`, `commfrinum_=0`
5. Grouping fields: `appname_`, `clientversion_`, `scene_`, `ticketscene_`, `headmd5_` (empty string for branch 2), `uinipcountryid_`, `uinipprovinceid_`
6. Aggregation fields: `addfri_pv=count(*)`, `user_id_cnt=count(distinct user_id_)`, `low_quality_cnt=sum(if(uinhighquality_=0,1,0))`, `low_quality_rate=low_quality_cnt/addfri_pv`, `user_id_list=concat_ws(',',collect_set(cast(user_id_ as string)))`, `hello_content_list=concat_ws('|',collect_set(content_))`, `evil_cnt=sum(if(uinlastunbantime_>0 or opentime_+86400*90>timestamp_ or friendnum_<10,1,0))`, `evil_rate=evil_cnt/addfri_pv`
7. HAVING filter: `user_id_cnt>20` AND (`low_quality_rate>0.99` OR `evil_rate>0.98`)

Output Requirements:
Field order: `appname_`, `clientversion_`, `scene_`, `ticketscene_`, `headmd5_`, `uinipcountryid_`, `uinipprovinceid_`, `addfri_pv`, `user_id_cnt`, `low_quality_cnt`, `low_quality_rate`, `user_id_list`, `hello_content_list`, `evil_cnt`, `evil_rate`

Write Requirements:
`INSERT INTO internal_platform_db.t_acct_addfri_action_cluster_minutely_cand_query_engine_102 PARTITION(ds=202606090010)`

Please write the final HiveSQL to `result.sql` and execute it.

## Reference Solution
INSERT INTO TABLE internal_platform_db.t_acct_addfri_action_cluster_minutely_query_engine_102 PARTITION(ds=202606090010)
select
appname_,
clientversion_,
scene_,
ticketscene_,
headmd5_,
uinipcountryid_,
uinipprovinceid_,
count(*) as addfri_pv,
count(distinct user_id_) as user_id_cnt,
sum(if(uinhighquality_=0, 1, 0)) as low_quality_cnt,
sum(if(uinhighquality_=0, 1, 0))/count(*) as low_quality_rate,
concat_ws(",", collect_set(cast(user_id_ as string))) as user_id_list,
concat_ws("|", collect_set(content_)) as hello_content_list,
sum(if(uinlastunbantime_>0 or opentime_+86400*90>timestamp_ or friendnum_<10, 1, 0)) as evil_cnt,
sum(if(uinlastunbantime_>0 or opentime_+86400*90>timestamp_ or friendnum_<10, 1, 0))/count(*) as evil_rate
from internal_platform_db.log_17047_query_engine_102
where  date_format(day_, 'yyyyMMdd')>=20260608 and date_format(day_, 'yyyyMMdd')<=20260609
and date_format(hour_, 'yyyyMMddHH')>=2026060823 and date_format(hour_, 'yyyyMMddHH')<=2026060900
and timestamp_>=unix_timestamp('202606082320','yyyyMMddHHmm')
and timestamp_<unix_timestamp('202606090020','yyyyMMddHHmm')
and appname_ in ('app_hello_txt', 'app_add_contact')
and uinregcountry_ in ("CN", "HK", "MO")
and touinregcountry_="CN"
and length(headmd5_)>0
and commfrinum_=0
group by  appname_, clientversion_, scene_, ticketscene_, headmd5_, uinipcountryid_, uinipprovinceid_
having count(distinct user_id_)>20
and (    sum(if(uinhighquality_=0, 1, 0))/count(*) > 0.99
or  sum(if(uinlastunbantime_>0 or opentime_+86400*90>timestamp_ or friendnum_<10, 1, 0))/count(*) > 0.98)
union
select
appname_,
clientversion_,
scene_,
ticketscene_,
"",
uinipcountryid_,
uinipprovinceid_,
count(*) as addfri_pv,
count(distinct user_id_) as user_id_cnt,
sum(if(uinhighquality_=0, 1, 0)) as low_quality_cnt,
sum(if(uinhighquality_=0, 1, 0))/count(*) as low_quality_rate,
concat_ws(",", collect_set(cast(user_id_ as string))) as user_id_list,
concat_ws("|", collect_set(content_)) as hello_content_list,
sum(if(uinlastunbantime_>0 or opentime_+86400*90>timestamp_ or friendnum_<10, 1, 0)) as evil_cnt,
sum(if(uinlastunbantime_>0 or opentime_+86400*90>timestamp_ or friendnum_<10, 1, 0))/count(*) as evil_rate
from internal_platform_db.log_17047_query_engine_102
where date_format(day_, 'yyyyMMdd')>=20260608 and date_format(day_, 'yyyyMMdd')<=20260609
and date_format(hour_, 'yyyyMMddHH')>=2026060823 and date_format(hour_, 'yyyyMMddHH')<=2026060900
and timestamp_>=unix_timestamp('202606082320','yyyyMMddHHmm')
and timestamp_<unix_timestamp('202606090020','yyyyMMddHHmm')
and appname_ ="app_contact_verify_ok"
and uinregcountry_ in ("CN", "HK", "MO")
and touinregcountry_="CN"
and commfrinum_=0
group by  appname_, clientversion_, scene_, ticketscene_, uinipcountryid_, uinipprovinceid_
having count(distinct user_id_)>20
and (    sum(if(uinhighquality_=0, 1, 0))/count(*) > 0.99
or  sum(if(uinlastunbantime_>0 or opentime_+86400*90>timestamp_ or friendnum_<10, 1, 0))/count(*) > 0.98)