VPCフローログ調査Athena

• DATABASE作成
• TABLE作成
• PARTITION作成
  後、以下

SELECT
  from_unixtime(starttime, 9, 0) AS starttime_jst,
  from_unixtime(endtime, 9, 0) AS endtime_jst,
  interfaceid,
  sourceaddress,
  destinationaddress,
  sourceport,
  destinationport,
  protocol,
  numpackets,
  numbytes,
  action,
  logstatus,
  sublocationtype
FROM <DATABASE>.<TABLE>
WHERE <PARTITION>
AND (sourceaddress = '<IP>' OR sourceaddress = '<IP>') 
AND destinationaddress = '<IP>'
AND from_unixtime(starttime, 9, 0) >= cast('2099-12-31 12:12:12 +09:00' as timestamp with time zone)
AND from_unixtime(starttime, 9, 0) <  cast('2099-12-31 12:12:12 +09:00' as timestamp with time zone)
ORDER BY starttime;