Package org.elasticsearch.xpack.esql.optimizer.rules.logical

Class ReplaceSparklineAggregate

java.lang.Object
org.elasticsearch.xpack.esql.rule.Rule<Aggregate,LogicalPlan>
org.elasticsearch.xpack.esql.rule.ParameterizedRule<Aggregate,LogicalPlan,LogicalOptimizerContext>
org.elasticsearch.xpack.esql.optimizer.rules.logical.OptimizerRules.ParameterizedOptimizerRule<Aggregate,LogicalOptimizerContext>
org.elasticsearch.xpack.esql.optimizer.rules.logical.ReplaceSparklineAggregate
public class ReplaceSparklineAggregate extends OptimizerRules.ParameterizedOptimizerRule<Aggregate,LogicalOptimizerContext>
Replaces a SPARKLINE aggregate into a three-phase execution pipeline that collects per-bucket values, sorts them chronologically, and fills in zero values for any empty time buckets.

Given the following query: 

     FROM logs
     | STATS s = SPARKLINE(MIN(errorCount), @timestamp, 10, "2024-01-01", "2024-02-01"), count = COUNT(*) BY host
The rule produces the following logical plan: 
     -- Phase 1: group by time bucket and collect the values
     STATS s = MIN(errorCount),
           $$count = TO_PARTIAL(COUNT(*))
     BY host, $$timestamp = BUCKET(@timestamp, 10, "2024-01-01", "2024-02-01")

     -- Phase 2: gather sorted (key, value) arrays per outer group
     STATS s          = TOP(s, 100, "asc", $$timestamp),
           $$timestamp = TOP($$timestamp, 100, "asc"),
           count         = FROM_PARTIAL($$count, COUNT(*))
     BY host

     -- Phase 3: fill gaps with zeros for buckets that have no data
     SparklineGenerateEmptyBuckets(phase2, rounding, minDate, maxDate, ...)
Note: All SPARKLINE calls within a single STATS command must share the same timestamp, buckets, from, and to arguments. At most 100 buckets are supported.