---
title: Range vector functions
description: PromQL range vector functions in Elasticsearch, including rate, increase, and the _over_time aggregates.
url: https://www.elastic.co/elastic/docs-builder/docs/3562/reference/query-languages/promql/functions/range-vector
products:
  - Elasticsearch
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Preview in 9.4
---

# Range vector functions
These functions take a range vector and return an instant vector with one value per series, computed over the selected time window.

## `absent_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns `1` if the range vector has no elements, and `0` otherwise.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
absent_over_time(nonexistent_metric[5m])
```

**Differences from Prometheus**
Evaluated per series and per time bucket: returns `true` (PromQL `1`) when the bucket has no samples and `false` (PromQL `0`) otherwise. This differs from Prometheus in two ways: Prometheus returns an empty result when samples exist (rather than `0`), and it reports a fully missing series by synthesizing a single `1` from the selector labels. Elasticsearch evaluates only series that already exist in the data, so it cannot flag a metric that is entirely absent.

## `avg_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the average value of all points in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
avg_over_time(http_requests_total[5m])
```


## `count_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the count of all values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
count_over_time(http_requests_total[5m])
```

**Differences from Prometheus**
Returns a `long` integer count rather than a floating-point value.

## `delta`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Calculates the difference between the first and last value of each time series in a range vector.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with `to_gauge`. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
delta(cpu_temp_celsius[2h])
```


## `deriv`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Calculates the per-second derivative of the time series using simple linear regression.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with `to_gauge`. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
deriv(node_memory_free_bytes[5m])
```


## `first_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the first value of each time series in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
first_over_time(http_requests_total[1h])
```

**Differences from Prometheus**
Accepts additional Elasticsearch field types (for example `keyword`, `ip`, and `date`) and returns counter inputs unchanged rather than rejecting or converting them.

## `idelta`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Calculates the difference between the last two samples of each time series in a range vector.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with `to_gauge`. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
idelta(cpu_temp_celsius[5m])
```


## `increase`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Calculates the increase in the time series in the range vector, adjusting for counter resets.
Requires a counter input; non-counter inputs are automatically coerced with `to_counter`. The metric's configured temporality (cumulative or delta) is honored. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
increase(http_requests_total[5m])
```

**Differences from Prometheus**
Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.

## `irate`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Calculates the per-second instant rate of increase based on the last two data points.
Requires a counter input; non-counter inputs are automatically coerced with `to_counter`. The metric's configured temporality (cumulative or delta) is honored. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
irate(http_requests_total[5m])
```


## `last_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the most recent value of each time series in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
last_over_time(http_requests_total[1h])
```

**Differences from Prometheus**
Accepts additional Elasticsearch field types (for example `keyword`, `ip`, and `date`) and returns counter inputs unchanged rather than rejecting or converting them.

## `max_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the maximum value of all points in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
max_over_time(http_requests_total[5m])
```


## `min_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the minimum value of all points in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
min_over_time(http_requests_total[5m])
```


## `present_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns `1` if the range vector has at least one element, and `0` otherwise.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
present_over_time(http_requests_total[5m])
```

**Differences from Prometheus**
Evaluated per series and per time bucket: returns `true` (PromQL `1`) when the bucket has at least one sample and `false` (PromQL `0`) otherwise. Prometheus returns `1` only for series that have samples and omits the rest; it never emits `0`.

## `quantile_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the φ-quantile (0 ≤ φ ≤ 1) of the values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="φ (scalar)">
    Quantile value (0 ≤ φ ≤ 1).
  </definition>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
quantile_over_time(0.5, http_requests_total[1h])
```

**Differences from Prometheus**
Computed using the Elasticsearch t-digest percentile aggregation, so results are approximate and may differ slightly from Prometheus's exact linear interpolation, particularly for small sample sets.

## `rate`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Calculates the per-second average rate of increase of the time series in the range vector.
Requires a counter input; non-counter inputs are automatically coerced with `to_counter`. The metric's configured temporality (cumulative or delta) is honored. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
rate(http_requests_total[5m])
```

**Differences from Prometheus**
Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.

## `stddev_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the population standard deviation of the values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
stddev_over_time(http_requests_total[5m])
```


## `stdvar_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the population variance of the values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
stdvar_over_time(http_requests_total[5m])
```


## `sum_over_time`

<applies-to>Elastic Stack: Preview in 9.4</applies-to>
Returns the sum of all values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
sum_over_time(http_requests_total[5m])
```