Type to search.

T-digest field type

Serverless Preview

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Preview

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Preview 9.3+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Preview since 9.3

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

A field to store pre-aggregated numerical data constructed using the T-Digest algorithm.

A tdigest field requires two arrays:

  • A centroids array of double, containing the computed centroids. These must be provided in ascending order.
  • A counts array of long, containing the computed counts for each of the centroids. This must be the same length as the centroids array

The field also accepts three optional summary fields:

  • sum, a double, representing the sum of the values being summarized by the t-digest
  • min, a double, representing the minimum of the values being summarized by the t-digest
  • max, a double, representing the maximum of the values being summarized by the t-digest

Specifying the summary values enables them to be calculated with higher accuracy from the raw data. If not specified, Elasticsearch computes them based on the given centroids and counts, with some loss of accuracy.

  • A tdigest field can only store a single sketch per document. Multi-values or nested arrays are not supported.
  • tdigest fields do not support sorting and are not searchable.

T-Digest fields accept two field-specific configuration parameters:

  • compression, a double between 0 and 10000 (excluding 0), which corresponds to the parameter of the same name in the T-Digest algorithm. In general, the higher this number, the more space on disk the field will use but the more accurate the sketch approximations will be. Default is 100
  • digest_type, which selects the merge strategy to use with the sketch. Valid values are default and high_accuracy. The default is default. The default is optimized for storage and performance, while still producing a good approximation. The high_accuracy variant uses more memory, disk, and CPU for a better approximation.

tdigest fields are primarily intended for use with aggregations. To make them efficient for aggregations, the data are stored as compact doc values and not indexed.

tdigest fields are supported in the following ES|QL aggregation functions:

tdigest fields support synthetic _source in their default configuration.

Note

To save space, zero-count buckets are not stored in tdigest doc values. If you index a tdigest field with zero-count buckets and synthetic _source is enabled, those buckets won't appear when you retrieve the field.

JSON
PUT my-index-000001
{
  "mappings": {
    "properties": {
      "latency": {
        "type": "tdigest"
      }
    }
  }
}
JSON
PUT my-index-000001/_doc/1
{
  "latency": {
    "centroids": [0.1, 0.2, 0.3, 0.4, 0.5],
    "counts": [3, 7, 23, 12, 6]
  }
}
JSON
POST /_query?format=txt
{
	"query": "FROM my-index-000001 | STATS Percentile(latency, 99)"
}