Skip to content

Conversation

@dnhatn
Copy link
Member

@dnhatn dnhatn commented Oct 14, 2025

This change updates the validation to reject time-series aggregations that cannot be executed. Specifically, if FN(field) is rewritten to FN(last_over_time(field)), and we don't support last_over_time(field), we should throw an error during planning rather than at runtime.

Closes #136270

@dnhatn dnhatn marked this pull request as ready for review October 14, 2025 05:05
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-storage-engine (Team:StorageEngine)

@dnhatn dnhatn force-pushed the validate-time-series branch from 6af2b1e to 5e82c63 Compare October 14, 2025 05:25
@dnhatn dnhatn added the auto-backport Automatically create backport pull requests when merged label Oct 14, 2025
+ "dimension fields, use the FROM command instead of the TS command.",
fa.sourceText(),
outer.sourceText()
"time-series aggregation inside function [{}] doesn't support type [{}]; only numeric types are supported,"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"time-series aggregation inside function [{}] doesn't support type [{}]; only numeric types are supported,"
"time-series aggregation function [{}] doesn't support type [{}]; only numeric types are supported,"

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see what you mean.. It'd be nice to include the name of the time-series agg too, like

"time-series aggregation [{}] inside function [{}] doesn't support type [{}]; only numeric types are supported,"

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Kostas - I updated the error message in 03afdb2

"1:11: cannot use dimension field [host] in a time-series aggregation function [count(host)]. "
+ "Dimension fields can only be used for grouping in a BY clause. "
+ "To aggregate dimension fields, use the FROM command instead of the TS command."
"1:11: time-series aggregation inside function [count(host)] doesn't support type [keyword]; "
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"1:11: time-series aggregation inside function [count(host)] doesn't support type [keyword]; "
"1:11: time-series aggregation function [count(host)] doesn't support type [keyword]; "

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is somewhat misleading though.. the function that doesn't support keyword is last_over_time, not count..

Can we surface the actual time-series function and include that in the error message, e.g. count(last_over_time(host)) here? This is now documented in a note in:
https://www.elastic.co/docs/reference/query-languages/esql/commands/ts

"Invalid call to dataType on an unresolved object \\?LASTOVERTIME", // https://github.com/elastic/elasticsearch/issues/134791
// https://github.com/elastic/elasticsearch/issues/134793
"class org.elasticsearch.compute.data..*Block cannot be cast to class org.elasticsearch.compute.data..*Block"
"time-series aggregation inside function * doesn't support type *"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this needs to be .* rather than *?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks Larisa - I fixed in 4944b52

)
);
assertThat(
error("TS test | STATS count(count_over_time(host)) BY bucket(@timestamp, 1 minute)", tsdb),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we maybe leave the old versions of these tests in as well, since we do still want these to not work, right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure about this. We can restore it, but count(count_over_time(host)) doesn't work, while count(count_over_time(name)) does. This seems inconsistent since both are keyword fields, except host is a dimension field and name is not

Copy link
Contributor

@kkrik-es kkrik-es left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome.

@dnhatn
Copy link
Member Author

dnhatn commented Oct 14, 2025

Thanks Kostas!

@dnhatn dnhatn merged commit 80b4b95 into elastic:main Oct 14, 2025
35 checks passed
@dnhatn dnhatn deleted the validate-time-series branch October 14, 2025 21:12
@elasticsearchmachine
Copy link
Collaborator

💔 Backport failed

Status Branch Result
9.2 Commit could not be cherrypicked due to conflicts

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 136517

@dnhatn
Copy link
Member Author

dnhatn commented Oct 15, 2025

💚 All backports created successfully

Status Branch Result
9.2

Questions ?

Please refer to the Backport tool documentation

dnhatn added a commit to dnhatn/elasticsearch that referenced this pull request Oct 15, 2025
This change updates the validation to reject time-series aggregations
that cannot be executed. Specifically, if FN(field) is rewritten to
FN(last_over_time(field)), and we don't support last_over_time(field),
we should throw an error during planning rather than at runtime.

Closes elastic#136270

(cherry picked from commit 80b4b95)
elasticsearchmachine pushed a commit that referenced this pull request Oct 15, 2025
)

This change updates the validation to reject time-series aggregations
that cannot be executed. Specifically, if FN(field) is rewritten to
FN(last_over_time(field)), and we don't support last_over_time(field),
we should throw an error during planning rather than at runtime.

Closes #136270

(cherry picked from commit 80b4b95)
Kubik42 pushed a commit to Kubik42/elasticsearch that referenced this pull request Oct 16, 2025
This change updates the validation to reject time-series aggregations 
that cannot be executed. Specifically, if FN(field) is rewritten to
FN(last_over_time(field)), and we don't support last_over_time(field),
we should throw an error during planning rather than at runtime.

Closes elastic#136270
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-backport Automatically create backport pull requests when merged >non-issue :StorageEngine/TSDB You know, for Metrics Team:StorageEngine v9.2.0 v9.3.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ES|QL] TS Command: Aggregation following Eval on the same field errors out

4 participants