ES|QL and the _size field

Elastic Stack Elasticsearch
1

Hi, is it possible to use _size field in ES|QL? I didn't find it mentioned in the limitations documentation.

We are trying to identify traces that generate too much data as feedback for developers what to optimize.

Example query summing size of all traces with the same name per service:

FROM .ds-traces-apm-default-2025.02.18-007935
| EVAL traceName=CASE(parent.id IS NULL, transaction.name, null) 
| STATS traceSize=SUM(_size), traceName=MAX(traceName) BY trace.id, service.name, service.environment 
| EVAL traceName=CASE(traceName IS NOT NULL, traceName, trace.id) 
| STATS sumTraceSizeMiB=TO_DOUBLE(SUM(traceSize))/(1024*1024) by traceName, service.name, service.environment 
| SORT sumTraceSizeMiB DESC 
| LIMIT 30

Results in error

Unable to retrieve search results

[esql] > Unexpected error from Elasticsearch: verification_exception - Found 1 problem
line 3:23: Unknown column [_size]

In discover I see _size correctly.

image
image3771×1059 172 KB

We are using Elastic Cloud 8.17.1.

2

I don't think it's possible to play with _size. _size is a metadata field, and I can't find it on the list of metadata fields that can be used with ESQL

1 Like