ES|QL RATE function
field- the counter field whose per-second average rate of increase is computed
window-
the time window over which the rate is computed
Calculates the per-second average rate of increase of a counter. Rate calculations account for breaks in monotonicity, such as counter resets when a service restarts, and extrapolate values within each bucketed time interval. Rate is the most appropriate aggregate function for counters. It is only allowed in a STATS command under a TS source command, to be properly applied per time series.
| field | window | result |
|---|---|---|
| counter_double | time_duration
|
double |
| counter_integer | time_duration
|
double |
| counter_long | time_duration
|
double |
TS k8s
| STATS max_rate=MAX(RATE(network.total_bytes_in)) BY time_bucket = TBUCKET(5minute)
| max_rate: double | time_bucket:date |
|---|---|
| 64.5 | 2024-05-10T00:20:00.000Z |
| 22.359074 | 2024-05-10T00:15:00.000Z |