Streamstats in ES|QL: running statistics over time windows
- Dominant language
- No language data
- Stars
- 6
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
**Streamstats in ES|QL provide running statistics over time windows**
**Value Proposition**
Add dynamic statistical calculations to each individual event as it is processed, based on preceding events or specific groupings. This command allows you to enrich your data with running totals, averages, and counts without altering the event structure, providing immediate context for trend analysis, performance monitoring, and anomaly detection.
**Expected Outcome**
Enriched Event Data: Each event can be augmented with statistics derived from a window of prior events, providing immediate context for its values.
Running Calculations: Users will be able to compute running sums, counts, averages, and other aggregate measures per event, over a specified window or group.
Temporal Trend Identification: Observe how metrics evolve over time for individual entities or across event sequences, assisting in identifying patterns or deviations.
Contextual Monitoring: Add event-specific statistics that aid in monitoring system behavior, user activity, or process performance by showing how current events relate to recent history.
Support for Anomaly Detection: Provide additional data points on each event, such as a rolling average or standard deviation, which can be used to identify unusual occurrences.
Preservation of Event Detail: Perform statistical analysis without aggregating away the original individual events, allowing for deeper investigation.
**Optional: Key user stories / use cases**
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.