ES|QL `SPARKLINE` function

Computes y-axis values of a sparkline graph for an aggregation over time.

Syntax

aggregation: Aggregation that calculates the y-axis value of the sparkline graph for each datapoint.
key: Date expression from which to derive buckets.
buckets: Target number of buckets.
from: Start of the range. Can be a date or a date expressed as a string.
to: End of the range. Can be a date or a date expressed as a string.

The values representing the y-axis values of a sparkline graph for a given aggregation over a period of time.

aggregation	key	buckets	from	to	result
double	date	integer	date	date	double
double	date	integer	date	keyword	double
double	date	integer	date	text	double
double	date	integer	keyword	date	double
double	date	integer	keyword	keyword	double
double	date	integer	keyword	text	double
double	date	integer	text	date	double
double	date	integer	text	keyword	double
double	date	integer	text	text	double
integer	date	integer	date	date	integer
integer	date	integer	date	keyword	integer
integer	date	integer	date	text	integer
integer	date	integer	keyword	date	integer
integer	date	integer	keyword	keyword	integer
integer	date	integer	keyword	text	integer
integer	date	integer	text	date	integer
integer	date	integer	text	keyword	integer
integer	date	integer	text	text	integer
long	date	integer	date	date	long
long	date	integer	date	keyword	long
long	date	integer	date	text	long
long	date	integer	keyword	date	long
long	date	integer	keyword	keyword	long
long	date	integer	keyword	text	long
long	date	integer	text	date	long
long	date	integer	text	keyword	long
long	date	integer	text	text	long

FROM employees
| STATS sparkline = SPARKLINE(COUNT(*), hire_date, 20, "1985-01-01T00:00:00Z", "1985-12-31T00:00:00Z")

sparkline:long
[0, 2, 0, 0, 1, 0, 1, 0, 1, 2, 4, 0]