Is it possible to Downsamp to a list of keyword values!

Elastic Stack Elasticsearch
1

Hello everyone,

I have a time series data stream (TSDS) set up with downsampling configured via ILM (e.g. downsample to 1d intervals daily). The index template is correctly marked with time_series_dimension.

My data includes a high-value keyword field for example channel.name that may changes within each time bucket. Examples: "marketing-campaign-A", "support-ticket-123", etc.

What I would like in the downsampled index For this keyword field have an aggregation/summary field that captures the unique values that appeared during the downsampling interval.

Ideally something like these in each downsampled document

  • channel_name_unique_values: ["marketing-A", "support-123"]

Questions:

  1. Is there currently (as of early 2026 / latest 8.x or 9.x) any way to achieve unique value aggregation / cardinality on a keyword field natively during downsampling?

  2. If not, what's the recommended alternative pattern for this use-case?

    • Thanks a lot for any insights!
2

Hi,

At the moment, downsampling for TSDS only supports numeric metric aggregations (min, max, sum, avg, value_count). It doesn’t support collecting or storing unique values from keyword fields during the downsampling process.

If you need something like a list of unique channel.name values per interval, the usual approach is to pre-aggregate the data before downsampling. This can be done with a transform or an ingest/enrichment pipeline that builds a summarized index where the unique values are stored (for example using a terms aggregation).

Then you can apply downsampling on the numeric metrics while keeping the summarized fields in that intermediate index.