Elasticsearch Version

9.3.0

Installed Plugins

No response

Java Version

bundled

OS Version

mac os

Problem Description

Received this report:

Maybe it is expected but I don't find a note in the documentation. It's perfectly legit to compute expressions in the STATS command (https://www.elastic.co/docs/reference/query-languages/esql/commands/stats-by) . For example:

TS metrics-prometheusreceiver* | STATS foo = 1000*MAX(x509_cert_not_after)

works. However, as soon as we perform some computations with "time-series" functions/aggregations like:

TS metrics-prometheusreceiver* | STATS foo = 1000*MAX(LAST_OVER_TIME(x509_cert_not_after)

This will return the following non-user-friendly error.

Unsupported expression [last_over_time(x509_cert_not_after{f}#74502, @timestamp{f}#74513)]

This works:

TS metrics-prometheusreceiver* | STATS foo = MAX(LAST_OVER_TIME(x509_cert_not_after) | EVAL foo = 1000 * foo

(don't think it's a good user-experience or at least the error does not seem very informative.

Steps to Reproduce

steps are described above (using a ts index)

Logs (if relevant)

No response