You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Implicitly use last_over_time for time-series aggregations (#134260)
Currently, time-series aggregations require two explicit aggregations:
an over-time aggregation and an outer aggregation. This means a query
like `TS metrics | STATS AVG(memory_usage)` calculates the average of
all `memory_usage` values, functioning in a document-centric way like
the `FROM` command. This is not the desired metrics-centric behavior for
the `TS` command.
This change proposes to implicitly use `last_over_time` for time-series
aggregations that do not specify an over-time aggregation.
For example:
```
TS metrics | STATS AVG(memory_usage)
```
becomes:
```
FROM metrics
| WHERE memory_usage IS NOT NULL
| STATS mem = last_over_time(memory) BY _tsid
| STATS AVG(mem) as `AVG(memory_usage)`
```
---
```
TS metrics | WHERE TRANGE(5m) | STATS AVG(memory_usage)
```
becomes:
```
FROM metrics
| WHERE memory_usage IS NOT NULL AND @timestamp < now() AND @timestamp >= now() - 5m
| STATS mem = last_over_time(memory) BY _tsid
| STATS AVG(mem) as `AVG(memory_usage)`
```
---
And:
```
TS metrics | WHERE TRANGE(5m) | STATS AVG(memory_usage), SUM(rate(requests)) BY cluster, TBUCKET(1m)
```
becomes:
```
FROM metrics
| WHERE (memory_usage IS NOT NULL OR requests IS NOT NULL)
AND @timestamp < now() AND @timestamp >= now() - 5m
| STATS m = last_over_time(memory), r=rate(requests), cluster=VALUES(cluster) BY _tsid, TBUCKET(1m)
| STATS AVG(m) as `AVG(memory_usage)`, SUM(r) as `SUM(rate(request))` BY cluster
```
---
This change does not require a default lookback window. Users can
specify the lookback window in the `WHERE` clause with `TRANGE`, as
shown in the last example.
Copy file name to clipboardExpand all lines: x-pack/plugin/esql/src/internalClusterTest/java/org/elasticsearch/xpack/esql/action/RandomizedTimeSeriesIT.java
0 commit comments