CREATE TABLE IF NOT EXISTS mabase_prod.classifications
(
    ip                String,
    ja4               String,
    label             LowCardinality(String),
    tags              Array(String),
    comment           String,
    confidence        Float32,
    features          String,
    analyst           String,
    created_at        DateTime DEFAULT now()
)
ENGINE = MergeTree()
PARTITION BY toYYYYMM(created_at)
ORDER BY (created_at, ip, ja4)
SETTINGS index_granularity = 8192;