elastic / elastic/elasticsearch
ESQL: STATS ... WITHOUT ...
- Dominant language
- Java
- Stars
- 77.9k
- Forks
- 26.1k
- PR merge metrics
- PR metrics pending
Description
### Description
In [PromQL](https://prometheus.io/docs/prometheus/latest/querying/operators/#aggregation-operators) you can write:
```
sum without (instance) (http_requests_total)
```
In our world that'd look like:
```
| STATS SUM(http_requests_total) WITHOUT instance
```
Borrowing from PromQL's docs example: If there are three dimensions in the stream, say `application`, `instance`, and `group`, then the `WITHOUT` example above is the same as:
```
| STATS SUM(http_requests_total) BY application, group
```
This seems like a nice short hand in TSDB-land. Maybe not if there are 15 dimensions or something, but in a reasonable world there aren't that many. So maybe we should build this kind of syntax for ESQL in TSDB.
Tricky thing: if you aren't purely in TSDB land, how do you know which fields are dimensions and which are unrelated labels and which are measures? That's all labeled for us on pure TSDB indices. But outside of there we don't know.
Contributor guide
Research direction
Start by reviewing ESQL's STATS grammar and the TSDB dimension metadata described in the issue; no file or test is named in the payload. Clarify how WITHOUT should distinguish dimensions from labels and measures, including non-TSDB indices, then identify the tests needed to establish the syntax and semantics.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- databases
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100