ES|QL METRICS_INFO command

The METRICS_INFO processing command retrieves information about the metrics available in time series data streams, along with their applicable dimensions and other metadata.

Use METRICS_INFO to discover which metrics exist, what types and units they have, and which dimensions apply to them without having to inspect index mappings or rely on the field capabilities API. Any WHERE filters that precede METRICS_INFO narrow the set of time series considered, so only metrics with matching data are returned.

METRICS_INFO
		

METRICS_INFO produces one row per distinct metric signature — that is, per unique combination of metric name and its properties across backing indices. When the same metric is defined with different properties (for example, different units) in different data streams, separate rows are returned for each variant.

The output contains the following columns, all of type keyword:

metric_name

The name of the metric field (single-valued).

data_stream

The data stream(s) that contain this metric (multi-valued when the metric is included in multiple data streams which align on the unit, metric type, and field type).

unit

The unit declared in the field mapping, such as bytes or packets (multi-valued when definitions differ across backing indices; may be null if no unit is declared).

metric_type

The metric type, for example counter or gauge (multi-valued when definitions differ across backing indices).

field_type

The Elasticsearch field type, for example long, double, or integer (multi-valued when definitions differ across backing indices).

dimension_fields

The dimension field names associated with this metric (multi-valued). The union of dimension keys across all time series for that metric.

• METRICS_INFO can only be used after a TS source command. Using it after FROM or other source commands produces an error.
• METRICS_INFO must appear before pipeline-breaking commands such as STATS, SORT, or LIMIT.
• The output replaces the original table: downstream commands operate on the metadata rows, not the raw time series documents.

Return every metric available in the targeted time series data stream, sorted alphabetically by name:

TS k8s
| METRICS_INFO
| SORT metric_name
		

Place a WHERE clause before METRICS_INFO to restrict the time series considered. Only metrics that have actual data matching the filter are returned:

TS k8s
| WHERE cluster == "prod"
| METRICS_INFO
| SORT metric_name
		

Use KEEP to return only the columns you need:

TS k8s
| WHERE cluster == "prod"
| METRICS_INFO
| KEEP metric_name, metric_type
| SORT metric_name
		

Use WHERE after METRICS_INFO to narrow results by metadata, for example to only counter metrics:

TS k8s
| METRICS_INFO
| WHERE metric_type == "counter"
| SORT metric_name
		

Use a LIKE pattern after METRICS_INFO to find metrics whose name matches a prefix or wildcard. This is useful for exploring a specific subsystem when you know part of the metric name:

TS k8s
| METRICS_INFO
| WHERE metric_name LIKE "network.eth0*"
| SORT metric_name
		

Combine with STATS to aggregate the metadata. For example, count distinct metrics whose name matches a pattern:

TS k8s
| METRICS_INFO
| WHERE metric_name LIKE "network.total*"
| STATS matching_metrics = COUNT_DISTINCT(metric_name)
		

Group the metric catalogue by metric_type to see how many counter, gauge, or other metrics exist:

TS k8s
| METRICS_INFO
| STATS metric_count = COUNT(*) BY metric_type
| SORT metric_type