In CDP, when the HiveProtoLoggingHook is configured, query information is automatically captured and stored in the 'query_data' folder, which is typically located where 'hive.hook.proto.base-directory' is set. These details are saved as protobuf files, and in Hive, you can utilize the ProtobufMessageSerDe to access them.
To read this captured data, you can create a table as shown below.
CREATE EXTERNAL TABLE `query_data`(
`eventtype` string COMMENT 'from deserializer',
`hivequeryid` string COMMENT 'from deserializer',
`timestamp` bigint COMMENT 'from deserializer',
`executionmode` string COMMENT 'from deserializer',
`requestuser` string COMMENT 'from deserializer',
`queue` string COMMENT 'from deserializer',
`user` string COMMENT 'from deserializer',
`operationid` string COMMENT 'from deserializer',
`tableswritten` array<string> COMMENT 'from deserializer',
`tablesread` array<string> COMMENT 'from deserializer',
`otherinfo` map<string,string> COMMENT 'from deserializer')
PARTITIONED BY (
`date` string)
ROW FORMAT SERDE
'org.apache.hadoop.hive.ql.io.protobuf.ProtobufMessageSerDe'
WITH SERDEPROPERTIES (
'proto.class'='org.apache.hadoop.hive.ql.hooks.proto.HiveHookEvents$HiveHookEventProto',
'proto.maptypes'='org.apache.hadoop.hive.ql.hooks.proto.MapFieldEntry')
STORED AS INPUTFORMAT
'org.apache.hadoop.hive.ql.io.protobuf.ProtobufMessageInputFormat'
OUTPUTFORMAT
'org.apache.hadoop.hive.ql.io.HiveNullValueSequenceFileOutputFormat'
LOCATION
'<query_datalocation>'
TBLPROPERTIES (
'bucketing_version'='2',
'proto.class'='org.apache.hadoop.hive.ql.hooks.proto.HiveHookEvents$HiveHookEventProto')
After creating the table, execute 'msck repair query_data sync partitions' to synchronize the partitions, and then you can retrieve and analyze the data using Beeline.