traefik_otel: aggregate counter metrics with the ES|QL TS command and scope cumulativetodelta to histograms

packages/traefik_otel/_dev/shared/kibana/traefik_otel-overview.yaml

@@ -65,14 +65,10 @@ dashboards:
         esql:
           type: metric
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_entrypoint_requests_total IS NOT NULL
-            - STATS total = SUM(traefik_entrypoint_requests_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-            - EVAL duration_sec = DATE_DIFF("seconds", min_ts, max_ts)
-            - EVAL request_rate = CASE(duration_sec > 0, total / duration_sec, 0.0)
-            - KEEP request_rate
+            - STATS request_rate = SUM(RATE(traefik_entrypoint_requests_total))
           primary:
             field: request_rate
             label: Req/sec
@@ -87,14 +83,12 @@ dashboards:
         esql:
           type: metric
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_entrypoint_requests_total IS NOT NULL
-            - STATS total = SUM(traefik_entrypoint_requests_total),
-              errors_5xx = SUM(traefik_entrypoint_requests_total)
-                WHERE attributes.code LIKE "5*"
+            - STATS total = SUM(RATE(traefik_entrypoint_requests_total)), errors_5xx = SUM(RATE(traefik_entrypoint_requests_total)) WHERE attributes.code LIKE "5*"
             - EVAL error_rate = CASE(total > 0, errors_5xx / total, 0.0)
-            - STATS error_rate = MAX(error_rate)
+            - KEEP error_rate
           primary:
             field: error_rate
             label: 5xx Rate
@@ -125,14 +119,10 @@ dashboards:
         esql:
           type: metric
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_entrypoint_responses_bytes_total IS NOT NULL
-            - STATS total = SUM(traefik_entrypoint_responses_bytes_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-            - EVAL duration_sec = DATE_DIFF("seconds", min_ts, max_ts)
-            - EVAL bytes_rate = CASE(duration_sec > 0, total / duration_sec, 0.0)
-            - KEEP bytes_rate
+            - STATS bytes_rate = SUM(RATE(traefik_entrypoint_responses_bytes_total))
           primary:
             field: bytes_rate
             label: Bytes/sec
@@ -147,15 +137,11 @@ dashboards:
           type: area
           mode: stacked
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_entrypoint_requests_total IS NOT NULL
-            - STATS total = SUM(traefik_entrypoint_requests_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend),
-                attributes.entrypoint
-            - EVAL bucket_secs = GREATEST(DATE_DIFF("seconds", min_ts, max_ts), 1)
-            - EVAL request_rate = total / bucket_secs
+            - STATS request_rate = SUM(RATE(traefik_entrypoint_requests_total))
+              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend), attributes.entrypoint
             - KEEP time_bucket, attributes.entrypoint, request_rate
             - SORT time_bucket ASC
           dimension:
@@ -180,15 +166,11 @@ dashboards:
           type: bar
           mode: stacked
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_entrypoint_requests_total IS NOT NULL
-            - STATS total = SUM(traefik_entrypoint_requests_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend),
-                attributes.code
-            - EVAL bucket_secs = GREATEST(DATE_DIFF("seconds", min_ts, max_ts), 1)
-            - EVAL requests = total / bucket_secs
+            - STATS requests = SUM(RATE(traefik_entrypoint_requests_total))
+              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend), attributes.code
             - KEEP time_bucket, attributes.code, requests
             - SORT time_bucket ASC
           dimension:
@@ -249,11 +231,10 @@ dashboards:
         esql:
           type: pie
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_entrypoint_requests_total IS NOT NULL
-            - STATS total_requests = SUM(traefik_entrypoint_requests_total)
-              BY attributes.code
+            - STATS total_requests = SUM(INCREASE(traefik_entrypoint_requests_total)) BY attributes.code
             - SORT total_requests DESC
             - LIMIT 10
           metrics:
@@ -270,14 +251,11 @@ dashboards:
         esql:
           type: line
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_entrypoint_responses_bytes_total IS NOT NULL
-            - STATS total = SUM(traefik_entrypoint_responses_bytes_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
+            - STATS bytes_rate = SUM(RATE(traefik_entrypoint_responses_bytes_total))
               BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend)
-            - EVAL bucket_secs = GREATEST(DATE_DIFF("seconds", min_ts, max_ts), 1)
-            - EVAL bytes_rate = total / bucket_secs
             - KEEP time_bucket, bytes_rate
             - SORT time_bucket ASC
           dimension:
@@ -298,11 +276,10 @@ dashboards:
         esql:
           type: datatable
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_entrypoint_requests_total IS NOT NULL
-            - STATS total_requests = SUM(traefik_entrypoint_requests_total)
-              BY attributes.entrypoint
+            - STATS total_requests = SUM(INCREASE(traefik_entrypoint_requests_total)) BY attributes.entrypoint
             - SORT total_requests DESC
             - LIMIT 20
           breakdowns:

packages/traefik_otel/_dev/shared/kibana/traefik_otel-process.yaml

@@ -61,14 +61,10 @@ dashboards:
         esql:
           type: metric
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE process_cpu_seconds_total IS NOT NULL
-            - STATS total = SUM(process_cpu_seconds_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-            - EVAL duration_sec = DATE_DIFF("seconds", min_ts, max_ts)
-            - EVAL cpu_rate = CASE(duration_sec > 0, total / duration_sec, 0.0)
-            - KEEP cpu_rate
+            - STATS cpu_rate = SUM(RATE(process_cpu_seconds_total))
           primary:
             field: cpu_rate
             label: CPU sec/sec
@@ -159,14 +155,11 @@ dashboards:
         esql:
           type: line
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE process_cpu_seconds_total IS NOT NULL
-            - STATS total = SUM(process_cpu_seconds_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
+            - STATS cpu_rate = SUM(RATE(process_cpu_seconds_total))
               BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend)
-            - EVAL bucket_secs = GREATEST(DATE_DIFF("seconds", min_ts, max_ts), 1)
-            - EVAL cpu_rate = total / bucket_secs
             - KEEP time_bucket, cpu_rate
             - SORT time_bucket ASC
           dimension:

packages/traefik_otel/_dev/shared/kibana/traefik_otel-services.yaml

@@ -64,14 +64,10 @@ dashboards:
         esql:
           type: metric
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_service_requests_total IS NOT NULL
-            - STATS total = SUM(traefik_service_requests_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-            - EVAL duration_sec = DATE_DIFF("seconds", min_ts, max_ts)
-            - EVAL request_rate = CASE(duration_sec > 0, total / duration_sec, 0.0)
-            - KEEP request_rate
+            - STATS request_rate = SUM(RATE(traefik_service_requests_total))
           primary:
             field: request_rate
             label: Req/sec
@@ -86,14 +82,12 @@ dashboards:
         esql:
           type: metric
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_service_requests_total IS NOT NULL
-            - STATS total = SUM(traefik_service_requests_total),
-              errors_5xx = SUM(traefik_service_requests_total)
-                WHERE attributes.code LIKE "5*"
+            - STATS total = SUM(RATE(traefik_service_requests_total)), errors_5xx = SUM(RATE(traefik_service_requests_total)) WHERE attributes.code LIKE "5*"
             - EVAL error_rate = CASE(total > 0, errors_5xx / total, 0.0)
-            - STATS error_rate = MAX(error_rate)
+            - KEEP error_rate
           primary:
             field: error_rate
             label: 5xx Rate
@@ -124,14 +118,10 @@ dashboards:
         esql:
           type: metric
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_service_responses_bytes_total IS NOT NULL
-            - STATS total = SUM(traefik_service_responses_bytes_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-            - EVAL duration_sec = DATE_DIFF("seconds", min_ts, max_ts)
-            - EVAL bytes_rate = CASE(duration_sec > 0, total / duration_sec, 0.0)
-            - KEEP bytes_rate
+            - STATS bytes_rate = SUM(RATE(traefik_service_responses_bytes_total))
           primary:
             field: bytes_rate
             label: Bytes/sec
@@ -145,15 +135,11 @@ dashboards:
           type: area
           mode: stacked
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_service_requests_total IS NOT NULL
-            - STATS total = SUM(traefik_service_requests_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend),
-                attributes.service
-            - EVAL bucket_secs = GREATEST(DATE_DIFF("seconds", min_ts, max_ts), 1)
-            - EVAL request_rate = total / bucket_secs
+            - STATS request_rate = SUM(RATE(traefik_service_requests_total))
+              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend), attributes.service
             - KEEP time_bucket, attributes.service, request_rate
             - SORT time_bucket ASC
           dimension:
@@ -178,16 +164,12 @@ dashboards:
           type: bar
           mode: stacked
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_service_requests_total IS NOT NULL
             - WHERE attributes.code LIKE "5*"
-            - STATS total = SUM(traefik_service_requests_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend),
-                attributes.service
-            - EVAL bucket_secs = GREATEST(DATE_DIFF("seconds", min_ts, max_ts), 1)
-            - EVAL errors = total / bucket_secs
+            - STATS errors = SUM(RATE(traefik_service_requests_total))
+              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend), attributes.service
             - KEEP time_bucket, attributes.service, errors
             - SORT time_bucket ASC
           dimension:
@@ -212,15 +194,11 @@ dashboards:
           type: bar
           mode: stacked
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_service_requests_total IS NOT NULL
-            - STATS total = SUM(traefik_service_requests_total),
-              min_ts = MIN(@timestamp), max_ts = MAX(@timestamp)
-              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend),
-                attributes.code
-            - EVAL bucket_secs = GREATEST(DATE_DIFF("seconds", min_ts, max_ts), 1)
-            - EVAL requests = total / bucket_secs
+            - STATS requests = SUM(RATE(traefik_service_requests_total))
+              BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend), attributes.code
             - KEEP time_bucket, attributes.code, requests
             - SORT time_bucket ASC
           dimension:
@@ -251,12 +229,10 @@ dashboards:
         esql:
           type: datatable
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_service_requests_total IS NOT NULL
-            - STATS total_requests = SUM(traefik_service_requests_total),
-              errors_5xx = SUM(traefik_service_requests_total)
-                WHERE attributes.code LIKE "5*"
+            - STATS total_requests = SUM(INCREASE(traefik_service_requests_total)), errors_5xx = SUM(INCREASE(traefik_service_requests_total)) WHERE attributes.code LIKE "5*"
               BY attributes.service
             - EVAL error_rate = CASE(total_requests > 0, errors_5xx / total_requests, 0.0)
             - SORT total_requests DESC
@@ -282,12 +258,10 @@ dashboards:
         esql:
           type: datatable
           query:
-            - FROM metrics-traefik.otel-*
+            - TS metrics-traefik.otel-*
             - WHERE data_stream.dataset == "traefik.otel"
             - WHERE traefik_service_requests_total IS NOT NULL
-            - STATS total_requests = SUM(traefik_service_requests_total),
-              errors_5xx = SUM(traefik_service_requests_total)
-                WHERE attributes.code LIKE "5*"
+            - STATS total_requests = SUM(INCREASE(traefik_service_requests_total)), errors_5xx = SUM(INCREASE(traefik_service_requests_total)) WHERE attributes.code LIKE "5*"
               BY attributes.service
             - WHERE total_requests > 0
             - EVAL error_rate = errors_5xx / total_requests