ES|QL: Add TRANGE ES|QL function

docs/changelog/136441.yaml

@@ -0,0 +1,6 @@
+pr: 136441
+summary: Add TRANGE ES|QL function
+area: ES|QL
+type: enhancement
+issues:
+ - 135599

docs/reference/query-languages/esql/_snippets/lists/date-time-functions.md

@@ -6,3 +6,4 @@
 * [`DAY_NAME`](../../functions-operators/date-time-functions.md#esql-day_name)
 * [`MONTH_NAME`](../../functions-operators/date-time-functions.md#esql-month_name)
 * [`NOW`](../../functions-operators/date-time-functions.md#esql-now)
+* [`TRANGE`](../../functions-operators/date-time-functions.md#esql-trange)

docs/reference/query-languages/esql/functions-operators/date-time-functions.md

@@ -40,3 +40,6 @@ mapped_pages:
 :::{include} ../_snippets/functions/layout/now.md
 :::
 
+:::{include} ../_snippets/functions/layout/trange.md
+:::
+

x-pack/plugin/esql/qa/testFixtures/src/main/resources/k8s-timeseries-absent-over-time.csv-spec

@@ -295,3 +295,23 @@ events_received:integer | pod:keyword | time_bucket:datetime
 0                       | two         | 2024-05-10T00:20:00.000Z
 0                       | two         | 2024-05-10T00:22:00.000Z
 ;
+
+trange_absolute_epoch_millis_with_aggregations
+required_capability: ts_command_v0
+required_capability: fn_trange
+
+TS k8s 
+| WHERE TRANGE("2024-05-10T00:20:00.000Z", "2024-05-10T00:25:00.000Z") 
+| STATS events_received = max(absent_over_time(events_received)) BY pod, time_bucket = tbucket(1 minute) 
+| SORT time_bucket
+| LIMIT 5
+;
+ignoreOrder:true
+
+events_received:boolean | pod:keyword | time_bucket:datetime
+false                   | one         | 2024-05-10T00:20:00.000Z
+false                   | three       | 2024-05-10T00:20:00.000Z
+false                   | three       | 2024-05-10T00:21:00.000Z
+false                   | two         | 2024-05-10T00:20:00.000Z
+true                    | one         | 2024-05-10T00:21:00.000Z
+;

x-pack/plugin/esql/qa/testFixtures/src/main/resources/k8s-timeseries-rate.csv-spec

@@ -242,3 +242,26 @@ rate_bytes_in:double | cluster:keyword | region:keyword | time_bucket:datetime
 5.4539153439153445   | prod            | [eu, us]       | 2024-05-10T00:00:00.000Z
 5.241187469367376    | staging         | us             | 2024-05-10T00:00:00.000Z
 ;
+
+trange_absolute_with_rate
+required_capability: ts_command_v0
+required_capability: fn_trange
+
+TS k8s
+| WHERE TRANGE("2024-05-10T00:15:00.000Z", "2024-05-10T00:25:00.000Z") 
+| STATS rate_bytes_in=AVG(RATE(network.total_bytes_in)) BY cluster, time_bucket = TBUCKET(2minute)
+| SORT rate_bytes_in NULLS FIRST, time_bucket, cluster
+| LIMIT 10;
+
+rate_bytes_in:double | cluster:keyword | time_bucket:datetime
+null                 | prod            | 2024-05-10T00:14:00.000Z
+null                 | staging         | 2024-05-10T00:14:00.000Z
+null                 | qa              | 2024-05-10T00:22:00.000Z
+0.0371323529411787   | staging         | 2024-05-10T00:22:00.000Z
+2.27097222222222     | qa              | 2024-05-10T00:20:00.000Z
+5.374305555555554    | staging         | 2024-05-10T00:16:00.000Z
+7.513221153846155    | staging         | 2024-05-10T00:20:00.000Z
+9.45                 | prod            | 2024-05-10T00:20:00.000Z
+9.83125              | prod            | 2024-05-10T00:22:00.000Z
+10.525               | staging         | 2024-05-10T00:18:00.000Z
+;