Equivalent to SQL window functions

(Sergey Berkovitch) #1

Is there any way to implement SQL window functions?

Here is my use case:
Multiple events reported with "Type" and "Timestamp" fields. I'm looking for a way to extract the latest occurrence of each type.

In SQL this can be easily achieved:
This is how my data looks like:

..and this is the desired output:

The following query achieves just that:

SELECT [Type],[Description] FROM (
FROM [test]
) T
WHERE T.[RowNumber] = 1

Yeah, I know Elastic is not a relational database. However, I was hoping this is feasible and I'm just unable to find out how...

(tri-man) #2

It looks like you are looking for the latest of each type. If yes, in this case do something similar to the link below and use "max" instead of "avg" on "timestamp" field.


From my experience with ES, sometimes it requires a two-step process to get what you want.

(Sergey Berkovitch) #3

Thanks for the prompt response!
I believe this approach will work. Although the best I can do is 3 queries and complex logic to build them on the fly:

  1. Fetch all the different types
  2. Construct a query to fetch max timestamps for all those types
  3. Construct a query to fetch the details (e.g. description) for given types & timestamps

Can you think of a better/shorter way?

(tri-man) #4

I think 1 and 2 can be done in one query.

(Nik Everett) #5

I should point out that pipeline aggregations offer somewhat window function like functionality. I haven't read the rest of the post because it looks like you have it covered so I'm not sure if they fit what you want. But they are a thing.

(Sergey Berkovitch) #6

Thanks guys, it looks like I don't have a choice but to implement my own logic to fetch this.
Hoped I'll get away with just one query to avoid implementing a middle tier...

(system) #7