Repository: lf-edge/ekuiper

Issue #943: Support Alias for Stream/Table in Join clause
Created: 2021-08-17T02:32:07Z
To allow self join

Duplicate issue #2536: Alias FROM stream AS stream_alias is not working like expected
Created: 2024-01-07T21:22:56Z
Environment:

eKuiper version: 1.12.1-slim, Docker
Hardware configuration: x86_64
OS: Ubuntu 22.04.3 LTS

What happened and what you expected to happen:
When I try to use stream_alias in a SQL SELECT FROM definition, when I use stream_alias on WHERE clause, is not working.
For example, this SQL query is working (not stream aliases):
SELECT * FROM failed_logins_count_same_user INNER JOIN successful_logins
ON `failed_logins_count_same_user.account_for_which_logon_failed.account_name` = `successful_logins.new_logon.account_name`
GROUP BY TumblingWindow(ss, 60)

And this one, that is identical but using a stream alias, is not working:
SELECT * FROM failed_logins_count_same_user AS failed INNER JOIN successful_logins AS successful
ON `failed.account_for_which_logon_failed.account_name` = `successful.new_logon.account_name`
GROUP BY TumblingWindow(ss, 60)

How to reproduce it (as minimally and precisely as possible):
The raw event received on first stream, failed_logins_count_same_user:
{"EndTime":1704656880000,"EventID":"4625","EventRecordIDs":["8175416","8175417","8175418","8175419","8175420","8175422","8175423","8175424","8175425","8175426"],"StartTime":1704656820000,"Total":10,"account_for_which_logon_failed.account_domain":"LAB","account_for_which_logon_failed.account_name":"Administrator","failure_information.failure_reason":"Unknown user name or bad password.","logon_type":"3","network_information.workstation_name":"AGUIDA-NTB"}

The raw event received on second stream, successful_logins, in the next 60 seconds of the first event:
{"ActivityID":"","Channel":"Security","Computer":"LABDC.LAB.ARG","DescriptionTitle":"An account was successfully logged on.","EventID":"4624","EventRecordID":"8156680","Keywords":"0x8020000000000000","Level":"0","Opcode":"0","ProcessID":"656","ProviderGUID":"","ProviderName":"Microsoft-Windows-Security-Auditing","RelatedActivityID":"","Task":"12544","ThreadID":"8344","TimeCreated":"2024/01/06 02:36:25.18752200","UserID":"","Version":"2","detailed_authentication_information.authentication_package":"NTLM","detailed_authentication_information.key_length":"128","detailed_authentication_information.logon_process":"NtLmSsp","detailed_authentication_information.package_name_(ntlm_only)":"NTLM V2","detailed_authentication_information.transited_services":"-","impersonation_level":"Impersonation","logon_information.elevated_token":"Yes","logon_information.logon_type":"3","logon_information.restricted_admin_mode":"-","logon_information.virtual_account":"No","network_information.source_network_address":"10.199.0.84","network_information.source_port":"0","network_information.workstation_name":"AGUIDA-NTB","new_logon.account_domain":"LAB","new_logon.account_name":"Administrator","new_logon.linked_logon_id":"0x0","new_logon.logon_guid":"{00000000-0000-0000-0000-000000000000}","new_logon.logon_id":"0x15319407F","new_logon.network_account_domain":"-","new_logon.network_account_name":"-","new_logon.security_id":"S-1-5-21-1212037701-3946723201-1981249032-500","process_information.process_id":"0x0","process_information.process_name":"-","subject.account_domain":"-","subject.account_name":"-","subject.logon_id":"0x0","subject.security_id":"S-1-0-0"}

The result output to a file of the SQL query that is working (the first one in the example at the top):
{"ActivityID":"","Channel":"Security","Computer":"LABDC.LAB.ARG","DescriptionTitle":"An account was successfully logged on.","EndTime":1704656880000,"EventID":"4625","EventRecordID":"8175445","EventRecordIDs":["8175416","8175417","8175418","8175419","8175420","8175422","8175423","8175424","8175425","8175426"],"Keywords":"0x8020000000000000","Level":"0","Opcode":"0","ProcessID":"656","ProviderGUID":"","ProviderName":"Microsoft-Windows-Security-Auditing","RelatedActivityID":"","StartTime":1704656820000,"Task":"12544","ThreadID":"1840","TimeCreated":"2024/01/07 19:48:17.167877000","Total":10,"UserID":"","Version":"2","account_for_which_logon_failed.account_domain":"LAB","account_for_which_logon_failed.account_name":"Administrator","detailed_authentication_information.authentication_package":"Kerberos","detailed_authentication_information.key_length":"0","detailed_authentication_information.logon_process":"Kerberos","detailed_authentication_information.package_name_(ntlm_only)":"-","detailed_authentication_information.transited_services":"-","failure_information.failure_reason":"Unknown user name or bad password.","impersonation_level":"Impersonation","logon_information.elevated_token":"Yes","logon_information.logon_type":"3","logon_information.restricted_admin_mode":"-","logon_information.virtual_account":"No","logon_type":"3","network_information.source_network_address":"::1","network_information.source_port":"58959","network_information.workstation_name":"AGUIDA-NTB","new_logon.account_domain":"LAB.ARG","new_logon.account_name":"LABDC$","new_logon.linked_logon_id":"0x0","new_logon.logon_guid":"{0983c1c7-d6f6-e760-93ea-ed1c71613c68}","new_logon.logon_id":"0x16D316671","new_logon.network_account_domain":"-","new_logon.network_account_name":"-","new_logon.security_id":"S-1-5-18","process_information.process_id":"0x0","process_information.process_name":"-","subject.account_domain":"-","subject.account_name":"-","subject.logon_id":"0x0","subject.security_id":"S-1-0-0"}

Anything else we need to know?:
Nothing in particular.

Closing comment (2024-01-08T00:53:30Z): This is a known issue and duplicate of #943. Let's track on that issue.