Range vector functions
These functions take a range vector and return an instant vector with one value per series, computed over the selected time window.
Returns 1 if the range vector has no elements, and nothing otherwise.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
absent_over_time(nonexistent_metric[5m])
Differences from Prometheus
Evaluated per series: returns 1 for a series that has documents in the range but no value of the field. Prometheus instead reports a selector without any sample by synthesizing a single 1 from the selector labels. Elasticsearch evaluates only series that already exist in the data, so it cannot flag a metric that is entirely absent, nor a gap in a field mapped as a time series metric, because only documents with a value of such a field are read.
Returns the average value of all points in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
avg_over_time(http_requests_total[5m])
Returns the number of times the value changed in each time series in a range vector.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
changes(process_start_time_seconds[1h])
Differences from Prometheus
Returns a long integer count rather than a floating-point value. A single Elasticsearch field has a fixed type, so transitions between float and native histogram samples cannot be represented.
Returns the count of all values in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
count_over_time(http_requests_total[5m])
Differences from Prometheus
Returns a long integer count rather than a floating-point value.
Calculates the difference between the first and last value of each time series in a range vector.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
delta(cpu_temp_celsius[2h])
Differences from Prometheus
delta on native histograms, such as delta(h[5m]), isn't supported yet.
Calculates the per-second derivative of the time series using simple linear regression.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
deriv(node_memory_free_bytes[5m])
Returns the first value of each time series in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
first_over_time(http_requests_total[1h])
Differences from Prometheus
Accepts additional Elasticsearch field types (for example keyword, ip, and date) and returns counter inputs unchanged rather than rejecting or converting them.
Calculates the difference between the last two samples of each time series in a range vector.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with to_gauge. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
idelta(cpu_temp_celsius[5m])
Calculates the increase in the time series in the range vector, adjusting for counter resets.
Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
increase(http_requests_total[5m])
Differences from Prometheus
Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.
Calculates the per-second instant rate of increase based on the last two data points.
Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
irate(http_requests_total[5m])
Differences from Prometheus
irate on native histograms, such as irate(h[5m]), isn't supported yet.
Returns the most recent value of each time series in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
last_over_time(http_requests_total[1h])
Differences from Prometheus
Accepts additional Elasticsearch field types (for example keyword, ip, and date) and returns counter inputs unchanged rather than rejecting or converting them.
Returns the maximum value of all points in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
max_over_time(http_requests_total[5m])
Returns the minimum value of all points in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
min_over_time(http_requests_total[5m])
Predicts the value of each time series t seconds after the evaluation time using simple linear regression.
Requires at least two float samples and should be used with gauges. Native histogram samples are ignored. Negative and fractional prediction horizons are supported. Duration literals retain millisecond precision: 500ms is equivalent to 0.5 seconds.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
t(scalar)- Prediction horizon in seconds.
Example
predict_linear(node_filesystem_free_bytes[1h], 3600)
Differences from Prometheus
A horizon computed by a function, such as predict_linear(x[1h], time()) or predict_linear(x[1h], scalar(y)), isn't supported yet. Use a number, a duration literal, or arithmetic on literals. A single Elasticsearch field has a fixed type, so a range that mixes float and native histogram samples cannot be represented.
Returns 1 for every series that has at least one sample in the range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
present_over_time(http_requests_total[5m])
Returns the φ-quantile (0 ≤ φ ≤ 1) of the values in the specified time range.
Return type
instant_vector
Parameters
φ(scalar)- Quantile value (0 ≤ φ ≤ 1).
v(range_vector)- Range vector input.
Example
quantile_over_time(0.5, http_requests_total[1h])
Differences from Prometheus
Computed using the Elasticsearch t-digest percentile aggregation, so results are approximate and may differ slightly from Prometheus's exact linear interpolation, particularly for small sample sets.
Calculates the per-second average rate of increase of the time series in the range vector.
Requires a counter input; non-counter inputs are automatically coerced with to_counter. The metric's configured temporality (cumulative or delta) is honored. The result is always a double.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
rate(http_requests_total[5m])
Differences from Prometheus
rate on native histograms, such as rate(h[5m]), isn't supported yet. Use increase instead, such as histogram_quantile(0.99, sum by (job) (increase(h[5m]))). Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.
Returns the population standard deviation of the values in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
stddev_over_time(http_requests_total[5m])
Returns the population variance of the values in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
stdvar_over_time(http_requests_total[5m])
Returns the sum of all values in the specified time range.
Return type
instant_vector
Parameters
v(range_vector)- Range vector input.
Example
sum_over_time(http_requests_total[5m])