ES|QL time series aggregation functions

The first STATS under a TS source command supports the following time series aggregation functions:

• [preview] ABSENT_OVER_TIME
• [preview] AVG_OVER_TIME
• [preview] COUNT_OVER_TIME
• [preview] COUNT_DISTINCT_OVER_TIME
• [preview] FIRST_OVER_TIME
• [preview] LAST_OVER_TIME
• [preview] MAX_OVER_TIME
• [preview] MIN_OVER_TIME
• [preview] PRESENT_OVER_TIME
• [preview] RATE
• [preview] SUM_OVER_TIME

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the absence of a field in the output result over time range.

Supported types

Example

TS k8s
| WHERE cluster == "prod" AND pod == "two"
| STATS events_received = max(absent_over_time(events_received)) BY pod, time_bucket = tbucket(2 minute)
		

Stack Planned

Syntax

×

Parameters

number

Expression that outputs values to average.

Description

Calculates the average over time of a numeric field.

Supported types

Example

TS k8s
| STATS max_cost=max(avg_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
		

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the count over time value of a field.

Supported types

Example

TS k8s
| STATS count=count(count_over_time(network.cost))
  BY cluster, time_bucket = bucket(@timestamp,1minute)
		

Stack Planned

Syntax

×

Parameters

field

precision

Precision threshold. Refer to AGG-COUNT-DISTINCT-APPROXIMATE. The maximum supported value is 40000. Thresholds above this number will have the same effect as a threshold of 40000. The default value is 3000.

Description

Calculates the count of distinct values over time for a field.

Supported types

Example

TS k8s
| STATS distincts=count_distinct(count_distinct_over_time(network.cost)),
        distincts_imprecise=count_distinct(count_distinct_over_time(network.cost, 100))
  BY cluster, time_bucket = bucket(@timestamp,1minute)
		

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the earliest value of a field, where recency determined by the @timestamp field.

Supported types

Example

TS k8s
| STATS max_cost=max(first_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
		

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the latest value of a field, where recency determined by the @timestamp field.

Supported types

Example

TS k8s
| STATS max_cost=max(last_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
		

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the maximum over time value of a field.

Supported types

Example

TS k8s
| STATS cost=sum(max_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
		

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the minimum over time value of a field.

Supported types

Example

TS k8s
| STATS cost=sum(min_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
		

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the presence of a field in the output result over time range.

Supported types

Example

TS k8s
| WHERE cluster == "prod" AND pod == "two"
| STATS events_received = max(present_over_time(events_received)) BY pod, time_bucket = tbucket(2 minute)
		

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the rate of a counter field.

Supported types

Example

TS k8s
| STATS max(rate(network.total_bytes_in)) BY time_bucket = bucket(@timestamp,5minute)
		

Stack Planned

Syntax

×

Parameters

field

Description

Calculates the sum over time value of a field.

Supported types

Example

TS k8s
| STATS sum_cost=sum(sum_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)