1、sql查查询时间在30s+
SELECT count(1) as 'doc_count', MILLISECOND_TIMESTAMP(@timestamp) DIV 1800000 * 1800000 as 'key' FROM table WHERE ((((error_message is not null AND error_message MATCH_PHRASE 'checkTokenFromOldCache') OR (error_stack_trace is not null AND error_stack_trace MATCH_PHRASE 'checkTokenFromOldCache') OR (throwable is not null AND throwable MATCH_PHRASE 'checkTokenFromOldCache') OR (data_error is not null AND data_error MATCH_PHRASE 'checkTokenFromOldCache') OR (message is not null AND message MATCH_PHRASE 'checkTokenFromOldCache'))) AND ((@timestamp >= '2025-09-22 03:44:12.823' AND @timestamp <= '2025-09-23 03:44:12.823'))) GROUP BY key ORDER BY doc_count
2、只查message也挺快的，就查一个条件，1s
SELECT count(1) as 'doc_count', MILLISECOND_TIMESTAMP(@timestamp) DIV 1800000 * 1800000 as 'key' FROM table WHERE ((((message is not null AND message MATCH_PHRASE 'checkTokenFromOldCache'))) AND ((@timestamp >= '2025-09-22 03:44:12.823' AND @timestamp <= '2025-09-23 03:44:12.823'))) GROUP BY key ORDER BY doc_count
3、把is not null条件去掉，查询也是1s
explain SELECT count(1) as 'doc_count', MILLISECOND_TIMESTAMP(@timestamp) DIV 1800000 * 1800000 as 'key' FROM table WHERE ((((error_message MATCH_PHRASE 'checkTokenFromOldCache') OR (error_stack_trace MATCH_PHRASE 'checkTokenFromOldCache') OR (throwable MATCH_PHRASE 'checkTokenFromOldCache') OR (data_error MATCH_PHRASE 'checkTokenFromOldCache') OR (message MATCH_PHRASE 'checkTokenFromOldCache'))) AND ((@timestamp >= '2025-09-22 03:44:12.823' AND @timestamp <= '2025-09-23 03:44:12.823'))) GROUP BY key ORDER BY doc_count
比较困惑为啥第一个查询会这么慢？
看官方文档is not null，not null，倒排索引都是支持加速的。
这个null值在倒排索引里面是不支持查询过滤的，在NOT场景下，比如过滤not class为'doris.com'，会把class为空的也过滤掉。
社区大佬们是怎么处理这种场景的，解决不了上面查询慢问题的话，我这考虑的以下方案
1、表字段设置不为null，设置默认值为空''。
