ES|QL INLINE STATS command

The INLINE STATS processing command groups rows according to a common value and calculates one or more aggregated values over the grouped rows. The results are appended as new columns to the input rows.

The command is identical to STATS except that it preserves all the columns from the input table.

INLINE STATS [column1 =] expression1 [WHERE boolean_expression1][,
      ...,
      [columnN =] expressionN [WHERE boolean_expressionN]]
      [BY [grouping_name1 =] grouping_expression1[,
          ...,
          [grouping_nameN = ] grouping_expressionN]]
		

columnX

The name by which the aggregated value is returned. If omitted, the name is equal to the corresponding expression (expressionX). If multiple columns have the same name, all but the rightmost column with this name will be ignored.

expressionX

An expression that computes an aggregated value.

grouping_expressionX

An expression that outputs the values to group by. If its name coincides with one of the existing or computed columns, that column will be overridden by this one.

boolean_expressionX

The condition that determines which rows are included when evaluating expressionX.

The INLINE STATS processing command groups rows according to a common value (also known as the grouping key), specified after BY, and calculates one or more aggregated values over the grouped rows. The output table contains the same number of rows as the input table. The command only adds new columns or overrides existing columns with the same name as the result.

If column names overlap, existing column values may be overridden and column order may change. The new columns are added/moved so that they appear in the order they are defined in the INLINE STATS command.

For the calculation of each aggregated value, the rows in a group can be filtered with WHERE. If BY is omitted the aggregations are applied over the entire dataset.

The following aggregation functions are supported:

• ABSENT
• AVG
• COUNT
• COUNT_DISTINCT
• MAX
• MEDIAN
• MEDIAN_ABSOLUTE_DEVIATION
• MIN
• PERCENTILE
• PRESENT
• SAMPLE
• ST_CENTROID_AGG
• ST_EXTENT_AGG
• STD_DEV
• SUM
• TOP
• VALUES
• VARIANCE
• WEIGHTED_AVG
• FIRST
• LAST

The following grouping functions are supported:

• BUCKET
• TBUCKET

The following examples show common INLINE STATS patterns.

Calculate a statistic on one column and group by the values of another:

FROM employees
| KEEP emp_no, languages, salary
| INLINE STATS max_salary = MAX(salary) BY languages
		

Omit BY to apply aggregations over the entire dataset. The order of the existing columns is preserved and the new column is added last:

FROM employees
| KEEP emp_no, languages, salary
| INLINE STATS max_salary = MAX(salary)
		

FROM employees
| WHERE still_hired
| KEEP emp_no, languages, salary, hire_date
| EVAL tenure = DATE_DIFF("year", hire_date, "2025-09-18T00:00:00")
| DROP hire_date
| INLINE STATS avg_salary = AVG(salary), count = count(*) BY languages, tenure
		

FROM employees
| KEEP emp_no, salary
| INLINE STATS avg_lt_50 = ROUND(AVG(salary)) WHERE salary < 50000,
               avg_lt_60 = ROUND(AVG(salary)) WHERE salary >=50000 AND salary < 60000,
               avg_gt_60 = ROUND(AVG(salary)) WHERE salary >= 60000
		

• The CATEGORIZE grouping function is not currently supported.
• You cannot currently use LIMIT (explicit or implicit) before INLINE STATS, because this can lead to unexpected results.
• You cannot currently use FORK before INLINE STATS, because FORK adds an implicit LIMIT to each branch, which can lead to unexpected results.