Package org.elasticsearch.xpack.esql.expression.function.aggregate

Class Sparkline

java.lang.Object
org.elasticsearch.xpack.esql.core.tree.Node<Expression>
org.elasticsearch.xpack.esql.core.expression.Expression
org.elasticsearch.xpack.esql.core.expression.function.Function
org.elasticsearch.xpack.esql.expression.function.aggregate.AggregateFunction
org.elasticsearch.xpack.esql.expression.function.aggregate.Sparkline
All Implemented Interfaces:
NamedWriteable, Writeable, PostAnalysisPlanVerificationAware, PostAnalysisVerificationAware, Resolvable, AggregateMetricDoubleNativeSupport
public class Sparkline extends AggregateFunction implements AggregateMetricDoubleNativeSupport, PostAnalysisVerificationAware
Collects an aggregation as a sparkline.

Take this example: 

| STATS mbo=SPARKLINE(MAX(bytes_out), @timestamp, 10, "2025-01-01", "2025-01-10"),
        l1m=SPARKLINE(  AVG(load_1m), @timestamp, 10, "2025-01-01", "2025-01-10")
     BY hostname

Which should render something like: 

┌────────────┬────────────┬────────────┐
│ mbo        │ l1m        │ hostname   │
├────────────┼────────────┼────────────┤
│ ▁▂▄▇█▆▃▂▁▁ │ ▃▃▄▄▅▅▄▃▃▂ │ web-01     │
│ ▂▃▃▄▅▅▄▃▂▂ │ ▅▅▆▇█▇▆▅▄▃ │ web-02     │
│ ▁▁▂▂▂▃▃▂▂▁ │ ▂▂▃▄▅▆▅▄▃▂ │ db-primary │
└────────────┴────────────┴────────────┘

Elasticsearch doesn't paint this picture. Instead, it returns a dense array: 

┌────────────────────────────────────────────────────────┬────────────────────────────────────────────────────┬────────────┐
│ mbo                                                    │ l1m                                                │ hostname   │
├────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┼────────────┤
│ [120, 340, 630, 4800, 9800, 5100, 1200, 340, 120, 100] │ [1.2, 1.3, 1.8, 2.1, 2.4, 2.7, 2.1, 1.5, 1.2, 0.9] │ web-01     │
│ [240, 380, 380,  490,  620,  620,  490, 380, 240, 240] │ [2.4, 2.4, 2.9, 3.4, 3.8, 3.4, 2.9, 2.4, 1.8, 1.2] │ web-02     │
│ [ 50,  50,  80,   80,   80,  120,  120,  80,  80,  50] │ [0.8, 0.8, 1.2, 1.6, 2.0, 2.4, 2.0, 1.6, 1.2, 0.8] │ db-primary │
└────────────────────────────────────────────────────────┴────────────────────────────────────────────────────┴────────────┘

This is implemented as much as possible using standard bits of the compute engine and ESQL like the Top agg. See the ReplaceSparklineAggregate rule and SparklineGenerateEmptyBucketsOperator for special implementation bits.