Description
In ESQL it is possible to have aggregations working on a constant as long as it comes from a source, however pushing it into the aggregation fails.
This works: row a = 1 | stats m = min(a) but the query stats m = min(1) does not.
We've been looking at adding a dedicated rule for optimizing this ( #100182) however the issue is rather related to folding aggregations.
A somewhat variant of this is folding the aggregation when the argument is the group key itself:
stats mi = min(k), ma = max(k), c = count(k), a = avg(k) by k which is the same as stats by k | keep k as mi, k as ma, k as c, k as a, k
Description
In ESQL it is possible to have aggregations working on a constant as long as it comes from a source, however pushing it into the aggregation fails.
This works:
row a = 1 | stats m = min(a)but the querystats m = min(1)does not.We've been looking at adding a dedicated rule for optimizing this ( #100182) however the issue is rather related to folding aggregations.
A somewhat variant of this is folding the aggregation when the argument is the group key itself:
stats mi = min(k), ma = max(k), c = count(k), a = avg(k) by kwhich is the same asstats by k | keep k as mi, k as ma, k as c, k as a, kagg(const)can be expressed using a multi-value function asmv_...(const)ESQL: Sum, Min, Max and Avg of constants #105454 ESQL: median, count and count_distinct over constants #107414PERCENTILE,MEDIAN_ABSOLUTE_DEVIATIONST_CENTROID_AGG)