elastic / elastic/elasticsearch

ESQL: STATS ... WITHOUT ...

Open
#116,183 2 comments 0 reactions 0 assignees View on GitHub
:Analytics/ES|QL :StorageEngine/TSDB >enhancement Team:Analytics Team:StorageEngine
Dominant language
Java
Stars
77.9k
Forks
26.1k
PR merge metrics
PR metrics pending

Description

### Description

In [PromQL](https://prometheus.io/docs/prometheus/latest/querying/operators/#aggregation-operators) you can write:
```
sum without (instance) (http_requests_total)
```

In our world that'd look like:
```
| STATS SUM(http_requests_total) WITHOUT instance
```

Borrowing from PromQL's docs example: If there are three dimensions in the stream, say `application`, `instance`, and `group`, then the `WITHOUT` example above is the same as:
```
| STATS SUM(http_requests_total) BY application, group
```

This seems like a nice short hand in TSDB-land. Maybe not if there are 15 dimensions or something, but in a reasonable world there aren't that many. So maybe we should build this kind of syntax for ESQL in TSDB.

Tricky thing: if you aren't purely in TSDB land, how do you know which fields are dimensions and which are unrelated labels and which are measures? That's all labeled for us on pure TSDB indices. But outside of there we don't know.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing ESQL's STATS grammar and the TSDB dimension metadata described in the issue; no file or test is named in the payload. Clarify how WITHOUT should distinguish dimensions from labels and measures, including non-TSDB indices, then identify the tests needed to establish the syntax and semantics.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
databases
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.