---
title: ES|QL COUNT_OVER_TIME function
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/count_over_time
products:
  - Elasticsearch
---

# ES|QL COUNT_OVER_TIME function
<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.2
</applies-to>


## Syntax

![Embedded](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/images/functions/count_over_time.svg)


## Parameters

<definitions>
  <definition term="field">
    the metric field to calculate the value for
  </definition>
  <definition term="window">
    the time window over which to compute the count over time
  </definition>
</definitions>


## Description

Calculates the count over time value of a field.

## Supported types


| field                   | window                                                                  | result |
|-------------------------|-------------------------------------------------------------------------|--------|
| aggregate_metric_double | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| boolean                 | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| cartesian_point         | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| cartesian_shape         | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| date                    | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| date_nanos              | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| double                  | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| geo_point               | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| geo_shape               | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| geohash                 | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| geohex                  | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| geotile                 | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| integer                 | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| ip                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| keyword                 | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| long                    | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| text                    | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| unsigned_long           | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |
| version                 | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long   |


## Example

```esql
TS k8s
| STATS count=COUNT(COUNT_OVER_TIME(network.cost))
  BY cluster, time_bucket = BUCKET(@timestamp,1minute)
```


| count:long | cluster:keyword | time_bucket:datetime     |
|------------|-----------------|--------------------------|
| 3          | staging         | 2024-05-10T00:22:00.000Z |
| 3          | prod            | 2024-05-10T00:20:00.000Z |
| 3          | prod            | 2024-05-10T00:19:00.000Z |