Forbidding dimension fields in aggregated stats - only allowed in grouping attributes

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plan/logical/TimeSeriesAggregate.java

@@ -119,6 +119,7 @@ public boolean equals(Object obj) {
     @Override
     public void postAnalysisVerification(Failures failures) {
         super.postAnalysisVerification(failures);
+        // We forbid grouping by a metric field itself. Metric fields are allowed only inside aggregate functions.
         groupings().forEach(g -> g.forEachDown(e -> {
             if (e instanceof FieldAttribute fieldAttr && fieldAttr.isMetric()) {
                 failures.add(
@@ -202,6 +203,20 @@ protected void checkTimeSeriesAggregates(Failures failures) {
                         fail(count, "count_star [{}] can't be used with TS command; use count on a field instead", outer.sourceText())
                     );
                 }
+                outer.forEachDown(FieldAttribute.class, fa -> {
+                    if (fa.isDimension()) {
+                        failures.add(
+                            fail(
+                                this,
+                                "cannot use dimension field [{}] in a time-series aggregation function [{}]. "
+                                    + "Dimension fields can only be used for grouping in a BY clause. To aggregate "
+                                    + "dimension fields, use the FROM command instead of the TS command.",
+                                fa.sourceText(),
+                                outer.sourceText()
+                            )
+                        );
+                    }
+                });
                 if (outer instanceof TimeSeriesAggregateFunction ts) {
                     outer.field()
                         .forEachDown(

x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/analysis/VerifierTests.java

@@ -2689,6 +2689,25 @@ public void testNoMetricInStatsByClause() {
         );
     }
 
+    public void testNoDimensionsInAggsOnlyInByClause() {
+        assertThat(
+            error("TS test | STATS count(host) BY bucket(@timestamp, 1 minute)", tsdb),
+            equalTo(
+                "1:11: cannot use dimension field [host] in a time-series aggregation function [count(host)]. "
+                    + "Dimension fields can only be used for grouping in a BY clause. "
+                    + "To aggregate dimension fields, use the FROM command instead of the TS command."
+            )
+        );
+        assertThat(
+            error("TS test | STATS count(to_string(host)) BY bucket(@timestamp, 1 minute)", tsdb),
+            equalTo(
+                "1:11: cannot use dimension field [host] in a time-series aggregation function [count(to_string(host))]. "
+                    + "Dimension fields can only be used for grouping in a BY clause. "
+                    + "To aggregate dimension fields, use the FROM command instead of the TS command."
+            )
+        );
+    }
+
     public void testSortInTimeSeries() {
         assertThat(
             error("TS test | SORT host | STATS avg(last_over_time(network.connections))", tsdb),