Skip to content

Conversation

leontyevdv
Copy link
Contributor

Add a new ES|QL PRESENT_OVER_TIME function that is similar to PRESENT, but is used to check the presence of values over a time series in the given field.

This has to be merged after #133986

Part of #131069

leontyevdv and others added 30 commits September 2, 2025 15:45
Add a new ES|QL function that checks for the presence of a field in the
output result. Presence means that the input expression yields any
non-null value.

Part of elastic#131069
Add unit tests and documentation for the PRESENT function.

Part of elastic#131069
Clean-up of the PRESENT function.

Part of elastic#131069
# Conflicts:
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java
- Change intermediate state for using boolean
- Add unit tests for PresentAggregatorFunctionTests and
PresentGroupingAggregatorFunctionTests

Part of elastic#131069
- Add union_types csv tests

Part of elastic#131069
- Comment out TestLogging on CsvTests
- Add missing DataTypes to the function

Part of elastic#131069
- Optimize AggregatorFunctions

Part of elastic#131069
Add PRESENT_OVER_TIME ES|QL function.

Part of elastic#131069
Add PRESENT_OVER_TIME ES|QL function.

Part of elastic#131069
Optimize AggregatorFunction

Part of elastic#131069
Optimize PresentGroupingAggregatorFunction

Part of elastic#131069
Add PresentErrorTests

Part of elastic#131069
# Conflicts:
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/aggregate/AggregateWritables.java
…t-over-time-function

# Conflicts:
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/aggregate/AggregateWritables.java
# Conflicts:
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/EsqlFunctionRegistry.java
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/aggregate/AggregateWritables.java
@leontyevdv leontyevdv requested a review from dnhatn September 9, 2025 09:21
@leontyevdv leontyevdv self-assigned this Sep 9, 2025
@leontyevdv leontyevdv added >enhancement Team:Analytics Meta label for analytical engine team (ESQL/Aggs/Geo) :StorageEngine/TSDB You know, for Metrics :Analytics/ES|QL AKA ESQL Team:StorageEngine v9.2.0 :StorageEngine/ES|QL Timeseries / metrics / logsdb capabilities in ES|QL labels Sep 9, 2025
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-analytical-engine (Team:Analytics)

@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-storage-engine (Team:StorageEngine)

@github-actions
Copy link
Contributor

github-actions bot commented Sep 9, 2025

🔍 Preview links for changed docs

@github-actions
Copy link
Contributor

github-actions bot commented Sep 9, 2025

ℹ️ Important: Docs version tagging

👋 Thanks for updating the docs! Just a friendly reminder that our docs are now cumulative. This means all 9.x versions are documented on the same page and published off of the main branch, instead of creating separate pages for each minor version.

We use applies_to tags to mark version-specific features and changes.

Expand for a quick overview

When to use applies_to tags:

✅ At the page level to indicate which products/deployments the content applies to (mandatory)
✅ When features change state (e.g. preview, ga) in a specific version
✅ When availability differs across deployments and environments

What NOT to do:

❌ Don't remove or replace information that applies to an older version
❌ Don't add new information that applies to a specific version without an applies_to tag
❌ Don't forget that applies_to tags can be used at the page, section, and inline level

🤔 Need help?

elasticsearchmachine and others added 4 commits September 9, 2025 09:30
Copy link
Member

@dnhatn dnhatn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've left some small comments, but looks good. Thanks @leontyevdv

tag = "present-by"
),
@Example(
description = "To check for the presence and return 1 when it's true and 0 when it's false",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we need to update this doc?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is meant to demonstrate how easy it is to convert boolean to integer in order to comply with PromQL in the future. We discussed these tests with @kkrik-es today and I added them and added one as an example to the documentation. Perhaps adding these examples was unnecessary? WDYT

Here is how it looks:

FROM employees
| WHERE emp_no == 10020
| STATS is_present = TO_INTEGER(PRESENT(languages))
;

is_present:integer
0
;

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I missed that. Thanks for explaining.

* Similar to {@link Present}, but it is used to check the presence of values over a time series in the given field.
*/
public class PresentOverTime extends TimeSeriesAggregateFunction {
public static final NamedWriteableRegistry.Entry ENTRY = new NamedWriteableRegistry.Entry(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add a serialization test or remove serialization support for this class? I don't think we serialize this class.

if (aggFunc instanceof Avg || aggFunc instanceof AvgOverTime) {
return AggregateMetricDoubleBlockBuilder.Metric.COUNT;
}
if (aggFunc instanceof Present || aggFunc instanceof PresentOverTime) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great, this function now supports downsampled data :)

@leontyevdv leontyevdv requested a review from dnhatn September 10, 2025 14:26
Copy link
Member

@dnhatn dnhatn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks Dima!

# Conflicts:
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java
#	x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/esql/60_usage.yml
@leontyevdv leontyevdv merged commit 500b68a into elastic:main Sep 10, 2025
34 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Analytics/ES|QL AKA ESQL >enhancement :StorageEngine/ES|QL Timeseries / metrics / logsdb capabilities in ES|QL :StorageEngine/TSDB You know, for Metrics Team:Analytics Meta label for analytical engine team (ESQL/Aggs/Geo) Team:StorageEngine v9.2.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants