ESQL was designed to work around many of the limitations of the Aggregations framework because it can plan it's actions and, one day, it'll be able to take multiple trips to the data nodes. We've been accumulating aggregations feature requests that needed something we'd like to do in ESQL for a long time. Here I'm going to link them:
--- notes
actually for ESQL I recommend a small variation: first() and last() should take the first and last field as designated by the current sorting key, while earliest() and latest() work with the @timestamp.
so for [@timestamp, key, value] --> [t1, foo, 1] [t2, bar, 2]
from .. | sort key | stats first(key) // returns "bar"
from .. | stats earliest(key) // returns "foo"
Description
ESQL was designed to work around many of the limitations of the Aggregations framework because it can plan it's actions and, one day, it'll be able to take multiple trips to the data nodes. We've been accumulating aggregations feature requests that needed something we'd like to do in ESQL for a long time. Here I'm going to link them:
--- notes actually for ESQL I recommend a small variation: first() and last() should take the first and last field as designated by the current sorting key, while earliest() and latest() work with the @timestamp.
so for [@timestamp, key, value] --> [t1, foo, 1] [t2, bar, 2] from .. | sort key | stats first(key) // returns "bar" from .. | stats earliest(key) // returns "foo"