[aws_otel] Improve ESQL queries by mrg-elastic · Pull Request #19799 · elastic/integrations

mrg-elastic · 2026-06-26T14:43:19Z

Proposed commit message

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Screenshots

…thy to normal

…series

…ormal

github-actions · 2026-06-26T14:52:51Z

TL;DR

Buildkite never reached package tests: the repository post-checkout hook failed while merging PR 19799 with main. The conflicts are the version/changelog entries for aws_ecs_otel, aws_rds_otel, and aws_sqs_otel.

Remediation

Rebase or merge main into the PR branch and resolve these files: packages/aws_ecs_otel/{manifest.yml,changelog.yml}, packages/aws_rds_otel/{manifest.yml,changelog.yml}, and packages/aws_sqs_otel/{manifest.yml,changelog.yml}.
Keep the new main changelog entries from PR 19797, then add this PR's entry above them with versions higher than main's current manifests: likely aws_ecs_otel 0.5.1, aws_rds_otel 0.6.1, and aws_sqs_otel 0.6.1. Also replace the placeholder changelog link /pull/999 with /pull/19799.
Validate by confirming git merge origin/main or the rebase completes without conflicts, then push so Buildkite can get past the pipeline upload step.

Investigation details

Root Cause

This is a merge conflict, not a test failure. The PR changes package versions from older base values (aws_ecs_otel 0.4.0 -> 0.4.1, aws_rds_otel 0.5.0 -> 0.5.1, aws_sqs_otel 0.5.0 -> 0.5.1), but current main already contains newer package metadata:

Package	`main` manifest	PR manifest	Conflict source
`aws_ecs_otel`	`0.5.0` at `packages/aws_ecs_otel/manifest.yml:4`	`0.4.1`	manifest/changelog both changed at top
`aws_rds_otel`	`0.6.0` at `packages/aws_rds_otel/manifest.yml:4`	`0.5.1`	manifest/changelog both changed at top
`aws_sqs_otel`	`0.6.0` at `packages/aws_sqs_otel/manifest.yml:4`	`0.5.1`	manifest/changelog both changed at top

main also has new top changelog entries from PR 19797 at packages/aws_ecs_otel/changelog.yml:2, packages/aws_rds_otel/changelog.yml:2, and packages/aws_sqs_otel/changelog.yml:2, while this PR adds different top entries in the same locations.

Evidence

Build: https://buildkite.com/elastic/integrations/builds/45128
Job/step: :pipeline::arrow_up: Upload Pipeline: .buildkite/pipeline.yml
Key log excerpt:

Auto-merging packages/aws_ecs_otel/changelog.yml
CONFLICT (content): Merge conflict in packages/aws_ecs_otel/changelog.yml
Auto-merging packages/aws_ecs_otel/manifest.yml
CONFLICT (content): Merge conflict in packages/aws_ecs_otel/manifest.yml
Auto-merging packages/aws_rds_otel/changelog.yml
CONFLICT (content): Merge conflict in packages/aws_rds_otel/changelog.yml
Auto-merging packages/aws_rds_otel/manifest.yml
CONFLICT (content): Merge conflict in packages/aws_rds_otel/manifest.yml
Auto-merging packages/aws_sqs_otel/changelog.yml
CONFLICT (content): Merge conflict in packages/aws_sqs_otel/changelog.yml
Auto-merging packages/aws_sqs_otel/manifest.yml
CONFLICT (content): Merge conflict in packages/aws_sqs_otel/manifest.yml
Automatic merge failed; fix conflicts and then commit the result.
Merge failed: 1

Verification

Not run locally; the failure occurs before the Buildkite pipeline upload completes, and the logs identify the exact merge-conflicting files.

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

…ments-2

github-actions · 2026-06-26T14:58:06Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

Copilot

Pull request overview

This PR updates AWS OpenTelemetry integration assets by refining several Kibana dashboard ESQL queries (primarily for SQS and RDS) and bumping package versions with corresponding changelog entries.

Changes:

Updated SQS and RDS dashboard panels to use revised ESQL patterns (e.g., TS pipelines, *_over_time functions, and explicit freshness filtering for “latest” state).
Bumped package versions for aws_sqs_otel (0.6.0 → 0.6.1), aws_rds_otel (0.6.0 → 0.6.1), and aws_ecs_otel (0.5.0 → 0.5.1).
Added changelog entries describing the dashboard query improvements.

Reviewed changes

Copilot reviewed 6 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/aws_sqs_otel/manifest.yml	Bumps SQS OTEL package version to 0.6.1.
packages/aws_sqs_otel/kibana/dashboard/aws_sqs_otel-b1c3d401-841f-43f1-9421-4afc51a2ec87.json	Updates multiple SQS dashboard panels’ ESQL queries and embedded Vega spec query logic.
packages/aws_sqs_otel/changelog.yml	Adds 0.6.1 changelog entry for the SQS dashboard query changes.
packages/aws_rds_otel/manifest.yml	Bumps RDS OTEL package version to 0.6.1.
packages/aws_rds_otel/kibana/dashboard/aws_rds_otel-c92e1216-83f6-4de7-9d7f-1bcb42d5988a.json	Updates multiple RDS dashboard panels’ ESQL queries and embedded Vega spec query logic (including “freshness” filtering).
packages/aws_rds_otel/changelog.yml	Adds 0.6.1 changelog entry for the RDS dashboard query changes.
packages/aws_ecs_otel/manifest.yml	Bumps ECS OTEL package version to 0.5.1.
packages/aws_ecs_otel/changelog.yml	Adds 0.5.1 changelog entry (currently inconsistent with the actual changes in this PR for ECS).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

The RDS/SQS/ECS status hexmaps classified resource status using a different aggregation than the "by status" donut and KPI panels, so the hexmap and overview counts could disagree: - RDS: hexmap classified low-storage from the Maximum FreeStorageSpace statistic (and last sample) while the overview used the Minimum statistic over the window. Switched the hexmap to a window-MIN of the Minimum statistic, aligned CPU/connections to window-MAX of Maximum, and matched the 5-minute staleness window. - SQS: hexmap classified stale from the Average AgeOfOldestMessage statistic; switched to Maximum to match the overview. - ECS: hexmap, worst-first table and status-over-time classified from window-max while the overview used the last sample. Switched these to last-of-Maximum and unified the idle/healthy thresholds with the donut. Verified: all dashboard ES|QL queries execute against a live cluster and hexmap status counts now match the donut/KPI counts per package. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The SQS and ECS status hexmap Vega-embedded ESQL queries started with FROM ... but, unlike every other ESQL panel in those dashboards (and the RDS hexmap), did not set `unmapped_fields = "nullify"`. On partially mapped index patterns this can fail at runtime with unmapped-field errors. Prefixed both raw_all queries to match the existing convention; the ts_probe ROW queries reference no fields and are left untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

mykola-elastic

LGTM, review comments resolved + manually tested in stack with data

infra-vault-gh-plugin-prod · 2026-06-29T10:00:22Z

💚 Build Succeeded

Buildkite Build
Commit: b70dad8

History

💚 Build #45186 succeeded b186d51
💚 Build #45142 succeeded fc2c7d8
💚 Build #45131 succeeded 4bc68da
💔 Build #45130 failed 411abca
💔 Build #45128 failed 3370ab8

The EC2 and ELB status hexmaps disagreed with their "by status" donut and KPI panels: - Both hexmaps lacked the recently-active staleness filter the overview panels apply (DATE_DIFF("minutes", last_seen, latest_global) <= 5), so the hexmaps counted entities that had stopped reporting earlier in the range. Added the same filter to both hexmap raw_all queries. - EC2: the overview panels classify an instance with no StatusCheckFailed data as "healthy", while the hexmap classified it as "no data". Aligned the hexmap to the overview (NULL StatusCheckFailed -> healthy). aws_lambda_otel was reviewed too and is already consistent (no change). Verified: hexmap status counts now match the donut/KPI counts per package against a live cluster (EC2 41=41, ELB 2=2); elastic-package lint passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@timestamp

Convert the status-hexmap raw_all ESQL from FROM to the TS time-series command across all six AWS OTel packages (rds, sqs, ecs, ec2, elb, lambda), consistent with the dashboards' other time-series panels. Each aggregation is expressed in its *_over_time form (MAX->MAX(MAX_OVER_TIME(...)), LAST(x,@timestamp)->MAX(LAST_OVER_TIME(x)), etc.); the redundant per-aggregation WHERE ... IS NOT NULL guards are dropped (CASE already nullifies non-matching stats). Besides the idiom alignment, TS corrects the per-series "last value" computation: FROM's LAST(CASE(...), @timestamp) could pick the wrong value when an entity has multiple stat series. This notably fixes the SQS hexmap, which previously disagreed with its donut (a stale queue was mis-classified idle); the TS hexmap now matches the donut exactly. Verified against a live cluster: all dashboard ES|QL queries execute (138/138), and hexmap status counts match the donut/KPI counts per package. Only aws_lambda_otel needed a version bump + changelog entry (newly joining the PR); the other five already carry their elastic#19799 entry. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The Lambda status hexmap grouped only BY FunctionName, while its "by status" donut/KPI panels (and every other package's hexmap) group BY FunctionName, cloud.region. With a function reporting from more than one region the donut would count it per-region but the hexmap would collapse it to one hexagon. Added cloud.region to the hexmap grouping so the two stay consistent. Verified against a live cluster: all dashboard queries execute and the hexmap status counts match the donut counts over the same time window.

elastic-vault-github-plugin-prod · 2026-06-29T11:15:12Z

✅ All changelog entries have the correct PR link.

infra-vault-gh-plugin-prod · 2026-06-29T11:32:56Z

💚 Build Succeeded

Buildkite Build
Commit: 45a7555

History

💚 Build #45189 succeeded fe3d55c
💚 Build #45188 succeeded b70dad8
💚 Build #45186 succeeded b186d51
💚 Build #45142 succeeded fc2c7d8
💚 Build #45131 succeeded 4bc68da
💔 Build #45130 failed 411abca

agithomas

LGTM!

mergify · 2026-06-29T11:50:19Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

elastic-vault-github-plugin-prod · 2026-06-29T12:19:49Z

Package aws_ec2_otel - 0.7.0 containing this change is available at https://epr.elastic.co/package/aws_ec2_otel/0.7.0/

elastic-vault-github-plugin-prod · 2026-06-29T12:19:50Z

Package aws_ecs_otel - 0.6.0 containing this change is available at https://epr.elastic.co/package/aws_ecs_otel/0.6.0/

elastic-vault-github-plugin-prod · 2026-06-29T12:19:51Z

Package aws_elb_metrics_otel - 0.7.0 containing this change is available at https://epr.elastic.co/package/aws_elb_metrics_otel/0.7.0/

elastic-vault-github-plugin-prod · 2026-06-29T12:19:52Z

Package aws_lambda_otel - 0.7.0 containing this change is available at https://epr.elastic.co/package/aws_lambda_otel/0.7.0/

elastic-vault-github-plugin-prod · 2026-06-29T12:19:53Z

Package aws_rds_otel - 0.7.0 containing this change is available at https://epr.elastic.co/package/aws_rds_otel/0.7.0/

elastic-vault-github-plugin-prod · 2026-06-29T12:19:54Z

Package aws_sqs_otel - 0.7.0 containing this change is available at https://epr.elastic.co/package/aws_sqs_otel/0.7.0/

mrg-elastic added 23 commits June 26, 2026 17:38

use latest datapoint not historical max for ecs status cards and donut

7d3e153

apply recommended esql for ecs total services

095e258

apply recommended esql for ecs hot card

40a4db6

apply recommended esql for ecs idle card

b11f894

use latest datapoint for all ecs status single-stats and donut

258d15f

apply recommended esql for ecs normal (healthy) card and rename label

8a1261f

unify ecs status panels on latest-state refined logic and rename heal…

4ccc50f

…thy to normal

apply recommended esql for ecs service count over time, drop no-data …

d7e2b1f

…series

apply recommended esql for ecs services table, keep account, rename n…

b322d0f

…ormal

merge where clauses in ecs cpu per-service chart

56a7f6b

merge where clauses in ecs memory per-service chart

82a7578

merge where clauses in ecs bytes processed per-service chart

bc073cd

merge where and rename new connections card to total

d121001

fix ecs active connections card to use average stat and merge where

cceaeaf

simplify ecs new connections per-service chart query

0d41a41

fix ecs active connections per-service chart to average stat

0283202

merge where clauses in ecs cpu and memory ranking bars

77061f1

apply recommended esql for sqs cards donut count and table

7960f05

add 5-min recency to sqs cards and donut, replace sqs hex map vega

3a0ffa9

apply recommended esql for rds cards donut and table

c4c48e7

replace rds hex map vega

18dc1a0

replace ecs hex map vega

8c3ae3c

bump versions and add changelog for esql query improvements

3370ab8

mrg-elastic added 3 commits June 26, 2026 17:55

bump versions and add changelog for esql query improvements

4615537

fix ecs cpu/memory chart threshold reference line query

411abca

Merge remote-tracking branch 'upstream/main' into aws-queries-improve…

4bc68da

…ments-2

tommyers-elastic requested a review from Copilot June 26, 2026 15:24

Copilot started reviewing on behalf of tommyers-elastic June 26, 2026 15:24 View session

Copilot AI reviewed Jun 26, 2026

View reviewed changes

Comment thread packages/aws_sqs_otel/kibana/dashboard/aws_sqs_otel-b1c3d401-841f-43f1-9421-4afc51a2ec87.json Outdated

Comment thread packages/aws_rds_otel/kibana/dashboard/aws_rds_otel-c92e1216-83f6-4de7-9d7f-1bcb42d5988a.json Outdated

Comment thread packages/aws_ecs_otel/changelog.yml Outdated

mykola-elastic and others added 3 commits June 29, 2026 12:18

remove odd changelog descriptions

b70dad8

mykola-elastic approved these changes Jun 29, 2026

View reviewed changes

mykola-elastic added Integration:aws_elb_metrics_otel AWS ELB Metrics OpenTelemetry Assets Integration:aws_ec2_otel AWS EC2 Metrics OpenTelemetry Assets labels Jun 29, 2026

mykola-elastic and others added 2 commits June 29, 2026 14:00

mykola-elastic added the Integration:aws_lambda_otel AWS Lambda Metrics OpenTelemetry Assets label Jun 29, 2026

mykola-elastic requested a review from tommyers-elastic June 29, 2026 11:32

infra-vault-gh-plugin-prod Bot deleted a comment from elasticmachine Jun 29, 2026

agithomas approved these changes Jun 29, 2026

View reviewed changes

mykola-elastic merged commit 76c81b7 into elastic:main Jun 29, 2026
11 checks passed

Navigation Menu

Uh oh!

[aws_otel] Improve ESQL queries - #19799

[aws_otel] Improve ESQL queries#19799
mykola-elastic merged 33 commits into
elastic:mainfrom
mrg-elastic:aws-queries-improvements-2

mrg-elastic commented Jun 26, 2026

github-actions Bot commented Jun 26, 2026

Root Cause

Evidence

Verification

github-actions Bot commented Jun 26, 2026

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

mykola-elastic left a comment

infra-vault-gh-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

infra-vault-gh-plugin-prod Bot commented Jun 29, 2026

agithomas left a comment

mergify Bot commented Jun 29, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

Labels

6 participants

Uh oh!

Conversation

mrg-elastic commented Jun 26, 2026

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

github-actions Bot commented Jun 26, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

github-actions Bot commented Jun 26, 2026

✅ Elastic Docs Style Checker (Vale)

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

mykola-elastic left a comment

Choose a reason for hiding this comment

infra-vault-gh-plugin-prod Bot commented Jun 29, 2026

💚 Build Succeeded

History

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

infra-vault-gh-plugin-prod Bot commented Jun 29, 2026

💚 Build Succeeded

History

agithomas left a comment

Choose a reason for hiding this comment

mergify Bot commented Jun 29, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

elastic-vault-github-plugin-prod Bot commented Jun 29, 2026

Labels

6 participants