- nebula 版本：3.8
- 部署方式： 单机
- 安装方式：源码编译
- 是否上生产环境：N
- 硬件信息
- 磁盘 500G
- CPU/内存 32C/64G
- vertex有30条数据，edge有256万数据，count一次需要8秒，GO查询需要30多秒，查询语句如下：
count：
MATCH (v:attack_node)-[e:attack_edge]->(v1:attack_node)
return count(e),count(DISTINCT v.attack_node)
GO：
GO 1 to 10 STEPS FROM “10.143.129.58” OVER attack_edge where attack_edge.threat_time >= datetime(“2025-11-11 17:13:09”)
and attack_edge.threat_time <= datetime(“2025-11-18 17:47:09”) YIELD attack_edge._src as src_ip, attack_edge._type as type,
attack_edge._dst as dst_ip, attack_edge.threat_time as threat_time, properties($^).is_hit_info as src_hit_info, properties($$).is_hit_info as dst_hit_info, properties($^).network_type as src_network_type, properties($$).network_type as dst_network_type | GROUP BY $-.src_ip,$-.dst_ip,$-.type YIELD $-.src_ip as src_ip,
$-.dst_ip as dst_ip, max($-.threat_time) as end_time, min($-.threat_time) as start_time, max($-.src_network_type) as src_network_type, max($-.dst_network_type) as dst_network_type, max($-.src_hit_info) as src_hit_info,max($-.dst_hit_info) as dst_hit_info, $-.type as type | ORDER by $-.start_time
GO语句的Profile：
1 Start {
“execTime”: “1(us)”,
“rows”: 0,
“totalTime”: “64(us)”,
“version”: 0
} outputVar: {
“colNames”: ,
“type”: “DATASET”,
“name”: “__Start_1”
}
5 GetVertices 4 {
“execTime”: “484(us)”,
“resp[0]”: {
“exec”: “503(us)”,
“host”: “192.168.31.163:9779”,
“total”: “1338(us)”
},
“rows”: 12,
“totalTime”: “1853(us)”,
“total_rpc”: “1534(us)”,
“version”: 0
} outputVar: {
“colNames”: ,
“type”: “DATASET”,
“name”: “__GetVertices_5”
}
inputVar: __Argument_4
space: 1
dedup: 1
limit: -1
filter:
orderBy:
src: COLUMN[-1]
props: [
{
“props”: [
“_tag”,
“asset_name”,
“asset_type”,
“ip”,
“ip_location”,
“is_hit_info”,
“network_type”
],
“tagId”: 2
}
]
exprs:
9 Project 14 {
“execTime”: “137(us)”,
“rows”: 7668383,
“totalTime”: “7502367(us)”,
“version”: 0
} outputVar: {
“colNames”: [
“src_ip”,
“type”,
“dst_ip”,
“threat_time”,
“src_hit_info”,
“dst_hit_info”,
“src_network_type”,
“dst_network_type”
],
“type”: “DATASET”,
“name”: “__Project_9”
}
inputVar: __Filter_8
columns: [
“$__COL_1 AS src_ip”,
“$__COL_2 AS type”,
“$__COL_3 AS dst_ip”,
“$__COL_0 AS threat_time”,
“properties($^).is_hit_info AS src_hit_info”,
“properties($$).is_hit_info AS dst_hit_info”,
“properties($^).network_type AS src_network_type”,
“properties($$).network_type AS dst_network_type”
]
11 Sort 10 {
“execTime”: “2380(us)”,
“rows”: 16,
“totalTime”: “2393(us)”,
“version”: 0
} outputVar: {
“colNames”: [
“src_ip”,
“dst_ip”,
“end_time”,
“start_time”,
“src_network_type”,
“dst_network_type”,
“src_hit_info”,
“dst_hit_info”,
“type”
],
“type”: “DATASET”,
“name”: “__Sort_11”
}
inputVar: __Aggregate_10
factors: [
{
“start_time”: “ASCEND”
}
]
10 Aggregate 9 {
“execTime”: “12566794(us)”,
“rows”: 16,
“totalTime”: “12566808(us)”,
“version”: 0
} outputVar: {
“colNames”: [
“src_ip”,
“dst_ip”,
“end_time”,
“start_time”,
“src_network_type”,
“dst_network_type”,
“src_hit_info”,
“dst_hit_info”,
“type”
],
“type”: “DATASET”,
“name”: “__Aggregate_10”
}
inputVar: __Project_9
groupKeys: [
“$-.src_ip”,
“$-.dst_ip”,
“$-.type”
]
groupItems: [
{
“expr”: “$-.src_ip”
},
{
“expr”: “$-.dst_ip”
},
{
“expr”: “max($-.threat_time)”
},
{
“expr”: “min($-.threat_time)”
},
{
“expr”: “max($-.src_network_type)”
},
{
“expr”: “max($-.dst_network_type)”
},
{
“expr”: “max($-.src_hit_info)”
},
{
“expr”: “max($-.dst_hit_info)”
},
{
“expr”: “$-.type”
}
]
4 Argument {
“execTime”: “0(us)”,
“rows”: 12,
“totalTime”: “1587023(us)”,
“version”: 0
} outputVar: {
“colNames”: [
“_expandall_dst”
],
“type”: “DATASET”,
“name”: “__Argument_4”
}
inputVar: __ExpandAll_3
alias: _expandall_dst
isInputVertexRequired: 0
2 Expand 1 {
“execTime”: “18(us)”,
“rows”: 1,
“totalTime”: “33(us)”,
“version”: 0
} outputVar: {
“colNames”: [
“_expand_vid”
],
“type”: “DATASET”,
“name”: “__Expand_2”
}
inputVar: __VAR_0
space: 1
dedup: 0
limit:
filter:
orderBy:
sample: false
joinInput: false
maxSteps: 0
edgeProps: [
{
“props”: [
“_dst”
],
“type”: 8
}
]
stepLimits:
14 HashLeftJoin 13,6 {
“execTime”: “3187876(us)”,
“rows”: 7668383,
“totalTime”: “3187886(us)”,
“version”: 0
} outputVar: {
“colNames”: [
“$^”,
“__COL_0”,
“__COL_1”,
“__COL_2”,
“__COL_3”,
“_expandall_dst”,
“$$”,
“_getVertex_vid”
],
“type”: “DATASET”,
“name”: “__Filter_8”
}
inputVar: {
“rightVar”: “__Project_6”,
“leftVar”: “__ExpandAll_3”
}
hashKeys: [
“COLUMN[-1]”
]
probeKeys: [
“COLUMN[-1]”
]
kind: HashLeftJoin
13 Filter 12 {
“execTime”: “269(us)”,
“rows”: 7668383,
“totalTime”: “2364332(us)”,
“version”: 0
} outputVar: {
“colNames”: [
“$^”,
“__COL_0”,
“__COL_1”,
“__COL_2”,
“__COL_3”,
“_expandall_dst”
],
“type”: “DATASET”,
“name”: “__ExpandAll_3”
}
inputVar: __ExpandAll_12
condition: (($__COL_0>=2025-11-11T17:13:09.000000000) AND ($__COL_0<=2025-11-18T17:47:09.000000000))
isStable: false
12 ExpandAll 2 {
“execTime”: “8212785(us)”,
“graphCacheExpandAllTime+7”: “414612(us)”,
“graphCacheExpandAllTime+8”: “501769(us)”,
“graphExpandAllTime+10”: “535521(us)”,
“graphExpandAllTime+11”: “514836(us)”,
“graphExpandAllTime+2”: “1301742(us)”,
“graphExpandAllTime+3”: “1267885(us)”,
“graphExpandAllTime+4”: “1507308(us)”,
“graphExpandAllTime+5”: “777442(us)”,
“graphExpandAllTime+6”: “1520612(us)”,
“graphExpandAllTime+7”: “307513(us)”,
“graphExpandAllTime+9”: “479423(us)”,
“resp[0]”: {
“exec”: “514008(us)”,
“host”: “192.168.31.163:9779”,
“storage_detail”: {
“GetNeighborsNode”: “513567(us)”,
“HashJoinNode”: “182(us)”,
“RelNode”: “513568(us)”,
“SingleEdgeNode”: “127(us)”,
“TagNode”: “42(us)”
},
“total”: “1031715(us)”
},
“rows”: 7668383,
“totalTime”: “14490155(us)”,
“version”: 0
} outputVar: {
“colNames”: [
“$^”,
“__COL_0”,
“__COL_1”,
“__COL_2”,
“__COL_3”,
“_expandall_dst”
],
“type”: “DATASET”,
“name”: “__ExpandAll_12”
}
inputVar: __Expand_2
space: 1
dedup: 0
limit: 9223372036854775807
filter:
orderBy:
sample: false
joinInput: false
maxSteps: 10
edgeProps: [
{
“props”: [
“_dst”,
“_src”,
“_type”,
“threat_time”
],
“type”: 8
}
]
stepLimits:
minSteps: 1
vertexProps: [
{
“props”: [
“_tag”,
“asset_name”,
“asset_type”,
“ip”,
“ip_location”,
“is_hit_info”,
“network_type”
],
“tagId”: 2
}
]
vertexColumns: [
“$^ AS $^”
]
edgeColumns: [
“attack_edge.threat_time AS __COL_0”,
“attack_edge._src AS __COL_1”,
“attack_edge._type AS __COL_2”,
“attack_edge._dst AS __COL_3”,
“*._dst AS _expandall_dst”
]
大佬 们帮忙看下，为什么查询这么慢？我在edge的threat_time上加了索引的！！！