---
title: Range vector functions
description: PromQL range vector functions in Elasticsearch, including rate, increase, and the _over_time aggregates.
url: https://www.elastic.co/elastic/docs-builder/docs/4659/reference/query-languages/promql/functions/range-vector
products:
  - Elasticsearch
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.5, Preview in 9.4
---

# Range vector functions
These functions take a range vector and return an instant vector with one value per series, computed over the selected time window.

## `absent_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns `1` if the range vector has no elements, and nothing otherwise.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
absent_over_time(nonexistent_metric[5m])
```

**Differences from Prometheus**
Evaluated per series: returns `1` for a series that has documents in the range but no value of the field. Prometheus instead reports a selector without any sample by synthesizing a single `1` from the selector labels. Elasticsearch evaluates only series that already exist in the data, so it cannot flag a metric that is entirely absent, nor a gap in a field mapped as a time series metric, because only documents with a value of such a field are read.

## `avg_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the average value of all points in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
avg_over_time(http_requests_total[5m])
```


## `changes`

<applies-to>Elastic Stack: Planned</applies-to>
Returns the number of times the value changed in each time series in a range vector.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
changes(process_start_time_seconds[1h])
```

**Differences from Prometheus**
Returns a `long` integer count rather than a floating-point value. A single Elasticsearch field has a fixed type, so transitions between float and native histogram samples cannot be represented.

## `count_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the count of all values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
count_over_time(http_requests_total[5m])
```

**Differences from Prometheus**
Returns a `long` integer count rather than a floating-point value.

## `delta`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Calculates the difference between the first and last value of each time series in a range vector.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with `to_gauge`. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
delta(cpu_temp_celsius[2h])
```


## `deriv`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Calculates the per-second derivative of the time series using simple linear regression.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with `to_gauge`. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
deriv(node_memory_free_bytes[5m])
```


## `first_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the first value of each time series in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
first_over_time(http_requests_total[1h])
```

**Differences from Prometheus**
Accepts additional Elasticsearch field types (for example `keyword`, `ip`, and `date`) and returns counter inputs unchanged rather than rejecting or converting them.

## `idelta`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Calculates the difference between the last two samples of each time series in a range vector.
Operates on gauges: counter inputs are automatically and transparently converted to a gauge with `to_gauge`. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
idelta(cpu_temp_celsius[5m])
```


## `increase`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Calculates the increase in the time series in the range vector, adjusting for counter resets.
Requires a counter input; non-counter inputs are automatically coerced with `to_counter`. The metric's configured temporality (cumulative or delta) is honored. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
increase(http_requests_total[5m])
```

**Differences from Prometheus**
Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.

## `irate`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Calculates the per-second instant rate of increase based on the last two data points.
Requires a counter input; non-counter inputs are automatically coerced with `to_counter`. The metric's configured temporality (cumulative or delta) is honored. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
irate(http_requests_total[5m])
```


## `last_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the most recent value of each time series in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
last_over_time(http_requests_total[1h])
```

**Differences from Prometheus**
Accepts additional Elasticsearch field types (for example `keyword`, `ip`, and `date`) and returns counter inputs unchanged rather than rejecting or converting them.

## `max_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the maximum value of all points in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
max_over_time(http_requests_total[5m])
```


## `min_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the minimum value of all points in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
min_over_time(http_requests_total[5m])
```


## `predict_linear`

<applies-to>Elastic Stack: Planned</applies-to>
Predicts the value of each time series t seconds after the evaluation time using simple linear regression.
Requires at least two float samples and should be used with gauges. Native histogram samples are ignored. Negative and fractional prediction horizons are supported. Duration literals retain millisecond precision: `500ms` is equivalent to `0.5` seconds.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
  <definition term="t (scalar)">
    Prediction horizon in seconds.
  </definition>
</definitions>

**Example**
```
predict_linear(node_filesystem_free_bytes[1h], 3600)
```

**Differences from Prometheus**
The prediction horizon must be a number, a duration literal, or arithmetic on literals. Scalar functions such as `time()` and `scalar(...)` are not supported. A single Elasticsearch field has a fixed type, so mixed float and native histogram ranges cannot be represented.

## `present_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns `1` for every series that has at least one sample in the range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
present_over_time(http_requests_total[5m])
```


## `quantile_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the φ-quantile (0 ≤ φ ≤ 1) of the values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="φ (scalar)">
    Quantile value (0 ≤ φ ≤ 1).
  </definition>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
quantile_over_time(0.5, http_requests_total[1h])
```

**Differences from Prometheus**
Computed using the Elasticsearch t-digest percentile aggregation, so results are approximate and may differ slightly from Prometheus's exact linear interpolation, particularly for small sample sets.

## `rate`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Calculates the per-second average rate of increase of the time series in the range vector.
Requires a counter input; non-counter inputs are automatically coerced with `to_counter`. The metric's configured temporality (cumulative or delta) is honored. The result is always a `double`.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
rate(http_requests_total[5m])
```

**Differences from Prometheus**
Elasticsearch computes the value over fixed time buckets and, at bucket boundaries, interpolates the counter value from the adjacent buckets' samples, falling back to Prometheus-style extrapolation wherever an adjacent bucket has no samples (the series edges and any gaps). Prometheus instead extrapolates within each range window, so results can differ slightly.

## `stddev_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the population standard deviation of the values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
stddev_over_time(http_requests_total[5m])
```


## `stdvar_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the population variance of the values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
stdvar_over_time(http_requests_total[5m])
```


## `sum_over_time`

<applies-to>Elastic Stack: Generally available since 9.5, Elastic Stack: Preview in 9.4</applies-to>
Returns the sum of all values in the specified time range.
**Return type**
`instant_vector`
**Parameters**
<definitions>
  <definition term="v (range_vector)">
    Range vector input.
  </definition>
</definitions>

**Example**
```
sum_over_time(http_requests_total[5m])
```