---
title: ES|QL FIRST_OVER_TIME function
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/first_over_time
products:
  - Elasticsearch
---

# ES|QL FIRST_OVER_TIME function
<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.2
</applies-to>


## Syntax

![Embedded](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/images/functions/first_over_time.svg)


## Parameters

<definitions>
  <definition term="field">
    the metric field to calculate the value for
  </definition>
  <definition term="window">
    the time window over which to compute the first over time value
  </definition>
</definitions>


## Description

Calculates the earliest value of a field, where recency determined by the `@timestamp` field.

## Supported types


| field                                                                        | window                                                                  | result                |
|------------------------------------------------------------------------------|-------------------------------------------------------------------------|-----------------------|
| counter_double                                                               | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | double                |
| counter_integer                                                              | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | integer               |
| counter_long                                                                 | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long                  |
| double                                                                       | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | double                |
| exponential_histogram <applies-to>Elastic Stack: Preview in 9.3</applies-to> | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | exponential_histogram |
| integer                                                                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | integer               |
| long                                                                         | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | long                  |
| tdigest <applies-to>Elastic Stack: Planned</applies-to>                      | time_duration <applies-to>Elastic Stack: Preview since 9.3</applies-to> | tdigest               |


## Example

```esql
TS k8s
| STATS max_cost=MAX(FIRST_OVER_TIME(network.cost)) BY cluster, time_bucket = TBUCKET(1minute)
```


| max_cost:double | cluster:keyword | time_bucket:datetime     |
|-----------------|-----------------|--------------------------|
| 12.375          | prod            | 2024-05-10T00:17:00.000Z |
| 12.375          | qa              | 2024-05-10T00:01:00.000Z |
| 12.25           | prod            | 2024-05-10T00:19:00.000Z |