Fields in live queries are fixed to @timestamp and @rawstring, which does not work with any aggregate functions

[jackskj]

What happened:
Enabling live query works only for "log panel". This is caused live query's expectation to have @timestamp and @rawstring fields.
These fields are only present when fetching logs, but are not present when using aggregate functions.

This is a significant limitation as aggregate functions are used to plot data as timeseries/barcharts/status etc.

It is possible to make live queries work with timeseries/barchart panels when paired with data transformations. However, the underlying query still cannot be aggregate.

What you expected to happen:

Live queries work with timeseries/barchart/stat panels without data transformations

How to reproduce it (as minimally and precisely as possible):

Run the following query:
* | timechart()
and plot it with timeseries panel.
it will work with regular query, but not with live query.

Anything else we need to know?:

timeseries/barchart/stat panels are expected to be used with this data sources's aggregate functions

I believe aggregate function results in live queries are guaranteed to return same fields as the stream runs.
For example, count() function will return a default _count field, while timechart() returns a default _bucket and _count fields.

A potential solution would be to dynamically convert results to frame based on first live query result. where:

• _bucketor @timestamp can be converted to data timestamp field in wide format, simmilar to non-live query
• _count is used as numer for stat panel
• any other fields from the first live query response are converted to strings

Environment:

• Grafana version: 11.5.2
• Plugin version: 1.8.1

[aangelisc]

Thanks for this @jackskj, I've added this to our backlog. Atm I consider this to be a feature request but we will have the discussion in our team.