Rate aggregation

[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

You can use a rate aggregation to analyze the rate at which a specific field changes over time. This type of aggregation is useful when you want to analyze fields like counters.

For example, imagine you have a counter field called restarts that increments each time a service restarts. You can use rate aggregation to get an alert if the service restarts more than X times within a specific time window (for example, per day).

Rates used in alerting rules are calculated by comparing the maximum value of the field in the previous bucket to the maximum value of the field in the current bucket and then dividing the result by the number of seconds in the selected interval. For example, if the value of the restarts increases, the rate would be calculated as:

(max_value_in_current_bucket - max_value_in_previous_bucket)/interval_in_seconds

In this example, let’s assume you have one document per bucket with the following data:

{
"timestamp": 0000,
"restarts": 0
}

{
"timestamp": 60000,
"restarts": 1
}

Let’s assume the timestamp is a UNIX timestamp in milliseconds, and we started counting on Thursday, January 1, 1970 12:00:00 AM. In that case, the rate will be calculated as follows:

(max_value_in_current_bucket - max_value_in_previous_bucket)/interval_in_seconds, where:

The rate calculation would be: (1 - 0) / 60 = 0.0166666666667

If you want to alert when the rate of restarts is above 1 within a 1-minute window, you would set the threshold above 0.0166666666667.

The calculation you need to use depends on the interval that’s selected.