ES|QL CLAMP function
Clamps values to a specified minimum and maximum range.
field- Expression to clamp. If
null, the function returnsnull. min- The min value to clamp data into.
max-
The max value to clamp data into.
Limits (or clamps) the values of all samples to have a lower limit of min and an upper limit of max.
| field | min | max | result |
|---|---|---|---|
| boolean | boolean | boolean | boolean |
| date | date | date | date |
| date_nanos | date_nanos | date_nanos | date_nanos |
| double | double | double | double |
| double | double | integer | double |
| double | double | long | double |
| double | integer | double | double |
| double | integer | integer | double |
| double | integer | long | double |
| double | long | double | double |
| double | long | integer | double |
| double | long | long | double |
| double | unsigned_long | unsigned_long | double |
| integer | double | double | double |
| integer | double | integer | double |
| integer | double | long | double |
| integer | integer | double | double |
| integer | integer | integer | integer |
| integer | integer | long | long |
| integer | long | double | double |
| integer | long | integer | long |
| integer | long | long | long |
| integer | unsigned_long | unsigned_long | unsigned_long |
| ip | ip | ip | ip |
| keyword | keyword | keyword | keyword |
| keyword | keyword | text | keyword |
| keyword | text | keyword | keyword |
| keyword | text | text | keyword |
| long | double | double | double |
| long | double | integer | double |
| long | double | long | double |
| long | integer | double | double |
| long | integer | integer | long |
| long | integer | long | long |
| long | long | double | double |
| long | long | integer | long |
| long | long | long | long |
| long | unsigned_long | unsigned_long | unsigned_long |
| text | keyword | keyword | keyword |
| text | keyword | text | keyword |
| text | text | keyword | keyword |
| text | text | text | keyword |
| unsigned_long | double | double | double |
| unsigned_long | integer | integer | unsigned_long |
| unsigned_long | long | long | long |
| unsigned_long | unsigned_long | unsigned_long | unsigned_long |
| version | version | version | version |
TS k8s
| EVAL full_clamped_cost = clamp(network.cost, clamp_max(network.bytes_in, 5), network.bytes_in / 100)
| KEEP full_clamped_cost, @timestamp
| full_clamped_cost:double | @timestamp:datetime |
|---|---|
| 10.0 | 2024-05-10T00:18:33.000Z |
| 9.0 | 2024-05-10T00:04:49.000Z |
| 9.0 | 2024-05-10T00:15:51.000Z |
| 9.0 | 2024-05-10T00:17:12.000Z |
| 9.0 | 2024-05-10T00:20:46.000Z |