可用select, regexp_extract, where, like, group by等sql函数
* and __tag__:__path__:/data/logs/app/adserver-response.log
| SELECT
regexp_extract(content, 'advertiserId\":(\d+),', 1) as advId,
count(*) as cnt
WHERE regexp_extract(content, 'clickTrackingUrls\":\[(.*?)\]', 1) like '%http:%'
group by regexp_extract(content, 'advertiserId\":(\d+),', 1)