Range vector functions

These functions take a range vector and return an instant vector with one value per series, computed over the selected time window.

`absent_over_time`

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Preview in 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Returns 1 if the range vector has no elements, and nothing otherwise.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

absent_over_time(nonexistent_metric[5m])

Note

Differences from Prometheus

Evaluated per series: returns 1 for a series that has documents in the range but no value of the field. Prometheus instead reports a selector without any sample by synthesizing a single 1 from the selector labels. Elasticsearch evaluates only series that already exist in the data, so it cannot flag a metric that is entirely absent, nor a gap in a field mapped as a time series metric, because only documents with a value of such a field are read.

`avg_over_time`

Returns the average value of all points in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

avg_over_time(http_requests_total[5m])

`changes`

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Returns the number of times the value changed in each time series in a range vector.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

changes(process_start_time_seconds[1h])

Note

Differences from Prometheus

Returns a long integer count rather than a floating-point value. A single Elasticsearch field has a fixed type, so transitions between float and native histogram samples cannot be represented.

`count_over_time`

Returns the count of all values in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

count_over_time(http_requests_total[5m])

Note

Differences from Prometheus

Returns a long integer count rather than a floating-point value.

`delta`

Calculates the difference between the first and last value of each time series in a range vector.

Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

delta(cpu_temp_celsius[2h])

Note

Differences from Prometheus

delta on native histograms, such as delta(h[5m]), isn't supported yet.

`deriv`

Calculates the per-second derivative of the time series using simple linear regression.

Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

deriv(node_memory_free_bytes[5m])

`first_over_time`

Returns the first value of each time series in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

first_over_time(http_requests_total[1h])

Note

Differences from Prometheus

Accepts additional Elasticsearch field types (for example keyword, ip, and date) and returns counter inputs unchanged rather than rejecting or converting them.

`idelta`

Calculates the difference between the last two samples of each time series in a range vector.

Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

idelta(cpu_temp_celsius[5m])

`increase`

Calculates the increase in the time series in the range vector, adjusting for counter resets.

Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

increase(http_requests_total[5m])

Note

Differences from Prometheus

Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.

`irate`

Calculates the per-second instant rate of increase based on the last two data points.

Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

irate(http_requests_total[5m])

Note

Differences from Prometheus

irate on native histograms, such as irate(h[5m]), isn't supported yet.

`last_over_time`

Returns the most recent value of each time series in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

last_over_time(http_requests_total[1h])

Note

Differences from Prometheus

Accepts additional Elasticsearch field types (for example keyword, ip, and date) and returns counter inputs unchanged rather than rejecting or converting them.

`max_over_time`

Returns the maximum value of all points in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

max_over_time(http_requests_total[5m])

`min_over_time`

Returns the minimum value of all points in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

min_over_time(http_requests_total[5m])

`predict_linear`

Predicts the value of each time series t seconds after the evaluation time using simple linear regression.

Requires at least two float samples and should be used with gauges. Native histogram samples are ignored. Negative and fractional prediction horizons are supported. Duration literals retain millisecond precision: 500ms is equivalent to 0.5 seconds.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.
t (scalar): Prediction horizon in seconds.

Example

predict_linear(node_filesystem_free_bytes[1h], 3600)

Note

Differences from Prometheus

A horizon computed by a function, such as predict_linear(x[1h], time()) or predict_linear(x[1h], scalar(y)), isn't supported yet. Use a number, a duration literal, or arithmetic on literals. A single Elasticsearch field has a fixed type, so a range that mixes float and native histogram samples cannot be represented.

`present_over_time`

Returns 1 for every series that has at least one sample in the range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

present_over_time(http_requests_total[5m])

`quantile_over_time`

Returns the φ-quantile (0 ≤ φ ≤ 1) of the values in the specified time range.

Return type

instant_vector

Parameters

φ (scalar): Quantile value (0 ≤ φ ≤ 1).
v (range_vector): Range vector input.

Example

quantile_over_time(0.5, http_requests_total[1h])

Note

Differences from Prometheus

Computed using the Elasticsearch t-digest percentile aggregation, so results are approximate and may differ slightly from Prometheus's exact linear interpolation, particularly for small sample sets.

`rate`

Calculates the per-second average rate of increase of the time series in the range vector.

Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

rate(http_requests_total[5m])

Note

Differences from Prometheus

rate on native histograms, such as rate(h[5m]), isn't supported yet. Use increase instead, such as histogram_quantile(0.99, sum by (job) (increase(h[5m]))). Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.

`stddev_over_time`

Returns the population standard deviation of the values in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

stddev_over_time(http_requests_total[5m])

`stdvar_over_time`

Returns the population variance of the values in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

stdvar_over_time(http_requests_total[5m])

`sum_over_time`

Returns the sum of all values in the specified time range.

Return type

instant_vector

Parameters

v (range_vector): Range vector input.

Example

sum_over_time(http_requests_total[5m])