Skip to content

Conversation

idegtiarenko
Copy link
Contributor

@idegtiarenko idegtiarenko commented Feb 10, 2025

This is my preliminary experiment targeted implementing first(value, @timestamp) function.
This is still WIP while I am finalizing related changes.

Depends on #122174
Resolves #108385

# Conflicts:
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/planner/AggregateMapper.java
first_grouped
required_capability: fn_first_last
FROM sample_data
| STATS event_duration = first_value(event_duration), message = first_value(message) BY hourly = BUCKET(@timestamp, 1 hour)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was hoping the function could be called first but this conflicts with nulls ordering keywords:

orderExpression
: booleanExpression ordering=(ASC | DESC)? (NULLS nullOrdering=(FIRST | LAST))?
;

Please let me know if it is worth to workaround it somehow (may be parsing first/last only in the sorting mode?)
Although it might not be trivial since sort uses expression mode as it is theoretically possible to:
| SORT first_value(event_duration) nulls first

@idegtiarenko
Copy link
Contributor Author

Outdated

@idegtiarenko idegtiarenko deleted the first_last branch October 6, 2025 09:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[ES|QL] Support first(), last() functions
2 participants