Skip to content

Conversation

@limotova
Copy link
Contributor

This commit adds support for running FirstOverTime and LastOverTime on counter fields (counter_long, counter_integer, counter_double).

The return value is the non-counter variation.
For example, the following is a valid query and will return a double:

TS my_tsdb
| STATS max(first_over_time(my_counter_double_field))
  BY my_dimension, bucket(@timestamp, 10minute)

This commit adds support for running FirstOverTime and LastOverTime on
counter fields (counter_long, counter_integer, counter_double).

The return value is the non-counter variation.
For example, the following is a valid query and will return a double:
```
TS my_tsdb
| STATS max(first_over_time(my_counter_double_field))
  BY my_dimension, bucket(@timestamp, 10minute)
```
@limotova limotova added the :StorageEngine/ES|QL Timeseries / metrics / logsdb capabilities in ES|QL label Sep 30, 2025
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-storage-engine (Team:StorageEngine)

@github-actions
Copy link
Contributor

ℹ️ Important: Docs version tagging

👋 Thanks for updating the docs! Just a friendly reminder that our docs are now cumulative. This means all 9.x versions are documented on the same page and published off of the main branch, instead of creating separate pages for each minor version.

We use applies_to tags to mark version-specific features and changes.

Expand for a quick overview

When to use applies_to tags:

✅ At the page level to indicate which products/deployments the content applies to (mandatory)
✅ When features change state (e.g. preview, ga) in a specific version
✅ When availability differs across deployments and environments

What NOT to do:

❌ Don't remove or replace information that applies to an older version
❌ Don't add new information that applies to a specific version without an applies_to tag
❌ Don't forget that applies_to tags can be used at the page, section, and inline level

🤔 Need help?

@dnhatn
Copy link
Member

dnhatn commented Sep 30, 2025

Are we sure we want over_time to work with counter fields? We have intentionally restricted counter fields to only rate and explicit casting.

@kkrik-es
Copy link
Contributor

kkrik-es commented Sep 30, 2025

I think we do, to support something like:

TS metrics | STATS requests

TS metrics | STATS max(requests) BY TBUCKET(5m)

Copy link
Member

@dnhatn dnhatn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am on the fence about adding this support, but if Kostas needs it, I am okay with it. LGTM, thanks Larisa!

@limotova
Copy link
Contributor Author

This build was successful, just status not reported, so I am merging this

@limotova limotova merged commit a780cf5 into elastic:main Sep 30, 2025
34 of 35 checks passed
@limotova limotova deleted the first-last-over-time-counters branch September 30, 2025 23:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

>non-issue :StorageEngine/ES|QL Timeseries / metrics / logsdb capabilities in ES|QL Team:StorageEngine v9.2.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants