-- =============================================================================
-- 01_raw_tables.sql — Raw ingest table (direct target for logcorrelator inserts)
-- =============================================================================

CREATE TABLE IF NOT EXISTS ja4_logs.http_logs_raw
(
    `raw_json`    String CODEC(ZSTD(3)),
    `ingest_time` DateTime DEFAULT now()
)
ENGINE = MergeTree
PARTITION BY toDate(ingest_time)
ORDER BY ingest_time
TTL ingest_time + INTERVAL 1 DAY
SETTINGS
    index_granularity = 8192,
    ttl_only_drop_parts = 1;