Skip to content

Conversation

@kkrik-es
Copy link
Contributor

Backport

This will backport the following commits from main to 9.2:

Questions ?

Please refer to the Backport tool documentation

With this change, we pack the dimension into a single value before the second aggregation in time-series queries and unpack it afterward. This avoids generating permutations for multi-valued dimensions in the second aggregation, which is not desirable. For example, the query ``` TS k8s | STATS max(rate(request)) BY host, tbucket(1minute) ``` is rewritten as: ```esql TS k8s | STATS rate=rate(request), host=VALUES(host) BY _tsid, tbucket=TBUCKET(1minute) | EVAL packed_host=PACK_DIMENSION(host) | STATS sum(rate) BY packed_host, tbucket | EVAL host=UNPACK_DIMENSION(packed_host) | KEEP rate, host, tbucket ``` There is some overhead with packing and unpacking values, but we tried to isolate this behavior to time-series queries with dimension fields only. That is why I chose this approach. (cherry picked from commit c8dc04d) # Conflicts: #	x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java
@kkrik-es kkrik-es merged commit 2041c7b into elastic:9.2 Oct 14, 2025
34 checks passed
@kkrik-es kkrik-es deleted the backport/9.2/pr-136216 branch October 30, 2025 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment