---
title: ES|QL time series aggregation functions
description: The first STATS under a TS source command supports aggregation functions per time series. These functions accept up to two arguments. The first argument...
url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions
products:
  - Elasticsearch
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# ES|QL time series aggregation functions
The first [`STATS`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/commands/stats-by) under a [`TS`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/commands/ts) source command supports
aggregation functions per time series. These functions accept up to two arguments.
The first argument is required and denotes the metric name of the time series.
The second argument is optional and allows specifying a sliding time window for
aggregating metric values. Note that this is orthogonal to time bucketing of
output results, as specified in the BY clause (e.g. through
[`TBUCKET`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/grouping-functions/tbucket)).
For example, the following query calculates the average rate of requests per
host for every minute, using values over a sliding window of 10 minutes:
```esql
TS metrics
  | WHERE TRANGE(1h)
  | STATS AVG(RATE(requests, 10m)) BY TBUCKET(1m), host
```

Accepted window values are currently limited to multiples of the time bucket
interval in the BY clause. If no window is specified, the time bucket interval
is implicitly used as a window.
The following time series aggregation functions are supported:
- [`ABSENT_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/absent_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`AVG_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/avg_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`COUNT_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/count_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`COUNT_DISTINCT_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/count_distinct_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`DELTA`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/delta) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`DERIV`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/deriv) <applies-to>Elastic Stack: Preview since 9.3</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`FIRST_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/first_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`IDELTA`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/idelta) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`INCREASE`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/increase) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`IRATE`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/irate) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`LAST_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/last_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`MAX_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/max_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`MIN_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/min_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`PERCENTILE_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/percentile_over_time) <applies-to>Elastic Stack: Preview since 9.3</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`PRESENT_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/present_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`RATE`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/rate) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`STDDEV_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/stddev_over_time) <applies-to>Elastic Stack: Preview since 9.3</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`SUM_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/sum_over_time) <applies-to>Elastic Stack: Preview since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>
- [`VARIANCE_OVER_TIME`](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/variance_over_time) <applies-to>Elastic Stack: Preview since 9.3</applies-to> <applies-to>Elastic Cloud Serverless: Preview</applies-to>