ES|QL TO_COUNTER function

×

field

Input value. The input can be a single- or multi-valued column or an expression.

Converts a numeric value to its counter equivalent. The output type is determined by the input: long converts to counter_long, integer to counter_integer, and double to counter_double. No values are modified; only the type annotation changes. If the input is already a counter, the function is a no-op. This is useful when a metric field was misclassified as a plain numeric type instead of a counter in the index mapping. This function is also available as the ::counter cast operator.

TS k8s
| STATS rate_bytes_in=avg(rate(network.total_bytes_in::counter)) BY time_bucket = bucket(@timestamp,1minute)
| EVAL rate_bytes_in=ROUND(rate_bytes_in, 6) | KEEP rate_bytes_in, time_bucket
| SORT rate_bytes_in DESC, time_bucket DESC | LIMIT 10;