Spot trends across thousands of groups at a glance without leaving your workflow. ES|QL's new SPARKLINE function turns aggregations into trend lines. One array per row, zero effort. Get hands-on with Elasticsearch: Dive into our sample notebooks in the Elasticsearch Labs repo , start a free cloud trial , or try Elastic on your local machine now . BY query and get back dozens or hundreds of results (log patterns, hosts, services, status codes), the counts alone don't tell you what's happening over time . Is the error count or log pattern climbing or settling down? Is it within the usual range?
To answer those questions today, you either build a separate time-series visualization or eyeball the numbers and hope for the best. This can be a lot of effort, time, and context switching for what should be just a glance. In this blog, we explain how Elasticsearch Query Language’s ( ES|QL ’s) SPARKLINE works, what it does, and how to get started. SPARKLINE is an ES|QL aggregate function with a straightforward signature: aggregation : Expression that calculates the y-axis value, including any supported aggregation: COUNT(*) , SUM(bytes) , AVG(latency) , or others. from / to : The time range boundaries.
(In Kibana , they bind to the time picker via query parameters. ) Under the hood, SPARKLINE buckets the time range, computes the aggregation per bucket, and packs the results into a single ordered array. Empty buckets are zero-filled so every group shares the same x-axis grid for fast, easy visual comparison. The function composes naturally with STATS ... BY , so you can combine it with any grouping. The first place you'll see SPARKLINE in action is Discover's log pattern analysis, starting 9.
When you run a CATEGORIZE query, Discover constructs the SPARKLINE query under the hood and renders trend lines next to each pattern. You don't write SPARKLINE yourself here; Discover handles it when you use the “identify patterns” option in the ES|QL editor. The result is immediate: You scan dozens of log patterns and instantly see which ones are spiking right now versus which have been steady all day. Consider a platform team investigating how they can cut logging costs. They point Discover at tens of millions of documents and let CATEGORIZE cluster them into patterns.