Can't use unwrapped x_over_time functions #133147
Description
Elasticsearch Version
main branch
Installed Plugins
No response
Java Version
24
OS Version
Darwin 24.6.0 Darwin Kernel Version 24.6.0: Mon Jul 14 11:30:40 PDT 2025; root:xnu-11417.140.69~1/RELEASE_ARM64_T6041 arm64
Problem Description
Can't use unwrapped x_over_time functions - they throw errors although when wrapped they work fine
Steps to Reproduce
curl -X PUT "http://localhost:9200/_index_template/my-timeseries-template" -H 'Content-Type: application/json' -d'
{
"index_patterns": ["my-timeseries-stream*"],
"data_stream": {},
"template": {
"settings": {
"index.mode": "time_series"
},
"mappings": {
"properties": {
"@timestamp": { "type": "date" },
"sensor_id": {
"type": "keyword",
"time_series_dimension": true
}
}
}
}
}'
curl -X POST "http://localhost:9200/my-timeseries-stream/_doc" -H 'Content-Type: application/json' -d'
{
"@timestamp": "2025-08-19T16:21:15.000Z",
"sensor_id": "sensor-1",
"message": "some message"
}
'
curl -X POST "http://localhost:9200/_query?format=json" -H 'Content-Type: application/json' -d'
{
"query": "TS my-timeseries-stream* | STATS max_over_time(@timestamp) BY tbucket=bucket(@timestamp, 1 minute) | LIMIT 5"
}
'
# Returns error:
# {"error":{"root_cause":[{"type":"illegal_state_exception","reason":"can't find input for [max_over_time(@timestamp){r}#76]"}],"type":"illegal_state_exception","reason":"can't find input for [max_over_time(@timestamp){r}#76]"},"status":500}%
curl -X POST "http://localhost:9200/_query?format=json" -H 'Content-Type: application/json' -d'
{
"query": "TS my-timeseries-stream* | STATS max(max_over_time(@timestamp)) BY tbucket=bucket(@timestamp, 1 minute) | LIMIT 5"
}
'
# Succeeds!
Logs (if relevant)
No response