Use STATS when you want ES|QL to summarize many Elasticsearch documents into a smaller result set. This example counts web responses by status code and destination country so you can quickly spot error patterns.
FROM kibana_sample_data_logs
| WHERE @timestamp >= NOW() - 24 hours
| STATS events = COUNT(*), total_bytes = SUM(bytes) BY response.keyword, geo.dest
| SORT events DESC
| LIMIT 20Why this ES|QL pattern helps
A raw event list is useful for inspection, but operations teams often need a grouped view first. STATS turns logs into metrics you can sort, visualize, save to a dashboard, or use as the starting point for a deeper investigation.
What to change for your data
- Group by
service.name,host.name,url.path, orerror.typeif those fields are more useful thangeo.dest. - Use
AVG(),MAX(),MIN(), or percentiles when analyzing latency or duration fields. - Keep the time window small while testing, then broaden it once the query returns the expected groups.
When to use it
This pattern fits Kibana dashboard panels, ES|QL alert previews, service health checks, and support workflows where users search for Elasticsearch ES|QL aggregation examples.
Source reference: Elastic documentation: Use ES|QL in the Kibana UI.