serverless: ga
stack: ga
The TS
command is similar to the FROM
source command,
but with two key differences: it targets only time-series indices
and enables the use of time-series aggregation functions
with the STATS command.
Syntax
TS index_pattern [METADATA fields]
Parameters
index_pattern
: A list of indices, data streams or aliases. Supports wildcards and date math.
fields
: A comma-separated list of metadata fields to retrieve.
Examples
TS metrics
| STATS sum(last_over_time(memory_usage))