Question

I have a table with the following:

  • eventid -> primary key, higher numbers mean newer
  • itemid -> foreign key to an items table
  • message -> event message

There will be 100/1000s of events for each itemid. What I need is to get the X newest events from the table for every unique value of itemid. In this case X is 20 and "newest" is the highest eventid.

What I was doing before is getting the entire table and only keeping the 20 newest for each itemid. This is very slow and inefficient.

Edit: I'm using opennms and the Events table (OpenNMS create.sql): (itemid == nodeID)

create table events (
eventID integer not null,
eventUei    varchar(256) not null,
nodeID  integer,
eventTime   timestamp with time zone not null,
eventHost   varchar(256),
eventSource varchar(128) not null,
ipAddr  varchar(16),
eventDpName varchar(12) not null,
eventSnmphost   varchar(256),
serviceID   integer,
eventSnmp   varchar(256),
eventParms  text,
eventCreateTime timestamp with time zone not null,
eventDescr  varchar(4000),
eventLoggroup   varchar(32),
eventLogmsg varchar(256),
eventSeverity   integer not null,
eventPathOutage varchar(1024),
eventCorrelation    varchar(1024),
eventSuppressedCount    integer,
eventOperInstruct   varchar(1024),
eventAutoAction varchar(256),
eventOperAction varchar(256),
eventOperActionMenuText varchar(64),
eventNotification   varchar(128),
eventTticket    varchar(128),
eventTticketState   integer,
eventForward    varchar(256),
eventMouseOverText  varchar(64),
eventLog    char(1) not null,
eventDisplay    char(1) not null,
eventAckUser    varchar(256),
eventAckTime    timestamp with time zone,
alarmID integer,
constraint pk_eventID primary key (eventID)
); 

My query was very simple:

SELECT eventid, nodeid, eventseverity, eventtime, eventlogmsg
FROM events
WHERE nodeid IS NOT NULL;
Was it helpful?

Solution

If you want a fixed number of "latest" entries, you need to use the window function row_number() (not rank()). Although, if the eventid happens to be unique (per itemid), the only (slight) difference is performance. (Your question update confirms that.)

Also, you need a subquery for this, since WHERE conditions are applied before window functions:

SELECT itemid, eventid, nodeid, eventseverity, eventtime, eventlogmsg
FROM  (
   SELECT itemid, eventid, nodeid, eventseverity, eventtime, eventlogmsg
         ,row_number() OVER (PARTITION BY itemid
                             ORDER BY eventid DESC NULLS LAST) AS rn
   FROM   events
   WHERE  nodeid IS NOT NULL
   ) sub
WHERE  rn <= 20
ORDER  BY 1, 2 DESC NULLS LAST;

The NULLS LAST clause is only relevant if eventid can be NULL, in which case this would sort rows with NULL values to the end. (Your question update rules that out, so the clause is not needed.)

OTHER TIPS

I would imagine that it is quite expensive and there may be better ways, but would something like this work for you?

select itemid, message 
from events e
where eventid in
  (select eventid from events f
   where e.itemid=f.itemid
   order by eventid desc
   limit 20)
order by itemid

The subquery finds the most recent items for a particular itemid and the outer query does that for all items. There is a mockup in sqlfiddle.

SELECT * FROM
( SELECT 
    eventid, 
    itemid, 
    message, 
    rank() OVER (PARTITION BY itemid ORDER BY eventid DESC) AS rnk
  FROM your_table)
WHERE rnk <= 20
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top