﻿---
title: ES|QL PRESENT_OVER_TIME function
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/2999/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/present_over_time
products:
  - Elasticsearch
---

# ES|QL PRESENT_OVER_TIME function
<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.2
</applies-to>


## Syntax

![Embedded](https://www.elastic.co/elastic/docs-builder/docs/2999/reference/query-languages/esql/images/functions/present_over_time.svg)


## Parameters

<definitions>
  <definition term="field">
    the metric field to calculate the value for
  </definition>
  <definition term="window">
    the time window over which to compute the present over time
  </definition>
</definitions>


## Description

Calculates the presence of a field in the output result over time range.

## Supported types


| field                                                                        | window                                                                  | result  |
|------------------------------------------------------------------------------|-------------------------------------------------------------------------|---------|
| aggregate_metric_double                                                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| boolean                                                                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| cartesian_point                                                              | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| cartesian_shape                                                              | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| date                                                                         | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| date_nanos                                                                   | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| double                                                                       | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| exponential_histogram <applies-to>Elastic Stack: Preview in 9.3</applies-to> | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| geo_point                                                                    | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| geo_shape                                                                    | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| geohash                                                                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| geohex                                                                       | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| geotile                                                                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| histogram <applies-to>Elastic Stack: Preview in 9.3</applies-to>             | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| integer                                                                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| ip                                                                           | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| keyword                                                                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| long                                                                         | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| tdigest <applies-to>Elastic Stack: Preview in 9.3</applies-to>               | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| text                                                                         | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| unsigned_long                                                                | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |
| version                                                                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | boolean |


## Example

```esql
TS k8s
| WHERE cluster == "prod" AND pod == "two"
| STATS events_received = MAX(PRESENT_OVER_TIME(events_received)) BY pod, time_bucket = TBUCKET(2 minute)
```


| events_received:boolean | pod:keyword | time_bucket:datetime     |
|-------------------------|-------------|--------------------------|
| true                    | two         | 2024-05-10T00:02:00.000Z |
| true                    | two         | 2024-05-10T00:08:00.000Z |
| false                   | two         | 2024-05-10T00:10:00.000Z |
| false                   | two         | 2024-05-10T00:12:00.000Z |