Skip to content

Conversation

kkrik-es
Copy link
Contributor

Backport

This will backport the following commits from main to 9.2:

Questions ?

Please refer to the Backport tool documentation

With this change, we pack the dimension into a single value before the
second aggregation in time-series queries and unpack it afterward. This
avoids generating permutations for multi-valued dimensions in the second
aggregation, which is not desirable.

For example, the query

```
TS k8s | STATS max(rate(request)) BY host, tbucket(1minute)
```

is rewritten as:

```esql
TS k8s
 | STATS rate=rate(request), host=VALUES(host) BY _tsid, tbucket=TBUCKET(1minute)
 | EVAL packed_host=PACK_DIMENSION(host)
 | STATS sum(rate) BY packed_host, tbucket
 | EVAL host=UNPACK_DIMENSION(packed_host)
 | KEEP rate, host, tbucket
```

There is some overhead with packing and unpacking values, but we tried
to isolate this behavior to time-series queries with dimension fields
only. That is why I chose this approach.

(cherry picked from commit c8dc04d)

# Conflicts:
#	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java
@kkrik-es kkrik-es merged commit 2041c7b into elastic:9.2 Oct 14, 2025
34 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants