Range vector functions
These functions take a range vector and return an instant vector with one value per series, computed over the selected time window.
Returns 1 if the range vector has no elements, and 0 otherwise.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
absent_over_time(nonexistent_metric[5m])
Differences from Prometheus
Evaluated per series and per time bucket: returns true (PromQL 1) when the bucket has no samples and false (PromQL 0) otherwise. This differs from Prometheus in two ways: Prometheus returns an empty result when samples exist (rather than 0), and it reports a fully missing series by synthesizing a single 1 from the selector labels. Elasticsearch evaluates only series that already exist in the data, so it cannot flag a metric that is entirely absent.
Returns the average value of all points in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
avg_over_time(http_requests_total[5m])
Returns the count of all values in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
count_over_time(http_requests_total[5m])
Differences from Prometheus
Returns a long integer count rather than a floating-point value.
Calculates the difference between the first and last value of each time series in a range vector.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
delta(cpu_temp_celsius[2h])
Calculates the per-second derivative of the time series using simple linear regression.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
deriv(node_memory_free_bytes[5m])
Returns the first value of each time series in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
first_over_time(http_requests_total[1h])
Differences from Prometheus
Accepts additional Elasticsearch field types (for example keyword, ip, and date) and returns counter inputs unchanged rather than rejecting or converting them.
Calculates the difference between the last two samples of each time series in a range vector.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
idelta(cpu_temp_celsius[5m])
Calculates the increase in the time series in the range vector, adjusting for counter resets.
Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
increase(http_requests_total[5m])
Differences from Prometheus
Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.
Calculates the per-second instant rate of increase based on the last two data points.
Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
irate(http_requests_total[5m])
Returns the most recent value of each time series in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
last_over_time(http_requests_total[1h])
Differences from Prometheus
Accepts additional Elasticsearch field types (for example keyword, ip, and date) and returns counter inputs unchanged rather than rejecting or converting them.
Returns the maximum value of all points in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
max_over_time(http_requests_total[5m])
Returns the minimum value of all points in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
min_over_time(http_requests_total[5m])
Returns 1 if the range vector has at least one element, and 0 otherwise.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
present_over_time(http_requests_total[5m])
Differences from Prometheus
Evaluated per series and per time bucket: returns true (PromQL 1) when the bucket has at least one sample and false (PromQL 0) otherwise. Prometheus returns 1 only for series that have samples and omits the rest; it never emits 0.
Returns the φ-quantile (0 ≤ φ ≤ 1) of the values in the specified time range.
Return type
instant_vector
Parameters
φ(scalar)- Quantile value (0 ≤ φ ≤ 1).
v(range_vector)- Range vector input.
Example
quantile_over_time(0.5, http_requests_total[1h])
Differences from Prometheus
Computed using the Elasticsearch t-digest percentile aggregation, so results are approximate and may differ slightly from Prometheus's exact linear interpolation, particularly for small sample sets.
Calculates the per-second average rate of increase of the time series in the range vector.
Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
rate(http_requests_total[5m])
Differences from Prometheus
Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.
Returns the population standard deviation of the values in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
stddev_over_time(http_requests_total[5m])
Returns the population variance of the values in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
stdvar_over_time(http_requests_total[5m])
Returns the sum of all values in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
sum_over_time(http_requests_total[5m])