期望使用 ' SUBSTRING_INDEX( GROUP_CONCAT( package.behaviors_num_today ORDER BY match_time desc), ',', 1 ) AS behaviors_num_today' 的结果进行排序.

但是实际上order by 的值是当前id最大的behaviors_num_today.

SELECT 
    * 
FROM
    (
    SELECT
        package.ip  as ip,
        SUBSTRING_INDEX( GROUP_CONCAT( package.behaviors_num_today ORDER BY match_time desc), ',', 1 ) AS behaviors_num_today
    FROM
        ip_statistical_package package
        LEFT JOIN ip_persona i ON package.ip = i.ip
        LEFT JOIN intelligence_source_tag ist ON i.ip = ist.ip
        LEFT JOIN tag t ON i.ip = t.ip
        LEFT JOIN intelligence_source_tag_name istn ON istn.source_tag_id = ist.id 
    GROUP BY
        package.ip
    ) a order by behaviors_num_today desc
    LIMIT 100 OFFSET 0;