# How to find the difference between aggregate min from aggregate max(max - min) in ES? **URL:** \ **Category:** Elasticsearch\ **Created:** [May 7, 2014, 11:37am UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390 "2014-05-07T11:37:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Alex\_Mathew](https://avatars.discourse-cdn.com/v4/letter/a/76d3ee/32.png) [@Alex\_Mathew](https://discuss.elastic.co/u/Alex_Mathew)\ **Post date:** [May 7, 2014, 11:37am UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390/1 "2014-05-07T11:37:13Z")
How to write an ES query to find the difference between max and min value of a field? I am a newbee in elastic search, In my case I feed lot of events along with session\_id and time in to elastic search. My event structure is Event\_name string Client\_id string App\_id string Session\_id string User\_id string Ip\_address string Latitude int64 Longitude int64 Event\_time time.Time I want to find the life time of a session\_id based the feeded events. For that I can retrive the maximum Event\_time and minimum Event\_time for a particular session\_id by the following ES query. { "size": 0, "query": { "match": { "Session\_id": "dummySessionId" } }, "aggs": { "max\_time": { "max": { "field": "Time" } }, "min\_time":{ "min": { "field": "Time" } } } } But what I exact want is (max\_time - min\_time) How to write the ES query for the same???? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\ **Post date:** [May 7, 2014, 12:01pm UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390/2 "2014-05-07T12:01:20Z")
Hi, There is no way to do it on the Elasticsearch side for the moment. It can only be done on client side. On Wed, May 7, 2014 at 1:37 PM, Alex Mathew [alexmathewsenapathy@gmail.com](mailto:alexmathewsenapathy@gmail.com)wrote: > How to write an ES query to find the difference between max and min value > of a field? > > I am a newbee in Elasticsearch, In my case I feed lot of events along > with session\_id and time in to Elasticsearch. My event structure is > > Event\_name string > Client\_id string > App\_id string > Session\_id string > User\_id string > Ip\_address string > Latitude int64 > Longitude int64 > Event\_time time.Time > > I want to find the life time of a session\_id based the feeded events. For that I can retrive the maximum Event\_time and minimum Event\_time for a particular session\_id by the following ES query. > > { > "size": 0, > "query": { > "match": { > "Session\_id": "dummySessionId" > } > }, > "aggs": { > "max\_time": { > "max": { > "field": "Time" > } > }, > "min\_time":{ > "min": { > "field": "Time" > } > } > } > } > > But what I exact want is (max\_time - min\_time) How to write the ES query for the same???? > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Adrien Grand -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j5%2BqaQzU6UAyD5-B%3Dv8R4yZQ%2B2wAUvH-%3D\_mSrWRHk\_erA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j5%2BqaQzU6UAyD5-B%3Dv8R4yZQ%2B2wAUvH-%3D_mSrWRHk_erA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Alex\_Mathew](https://avatars.discourse-cdn.com/v4/letter/a/76d3ee/32.png) [@Alex\_Mathew](https://discuss.elastic.co/u/Alex_Mathew)\ **Post date:** [May 7, 2014, 12:13pm UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390/3 "2014-05-07T12:13:36Z")
Thank you Adrien Grand for reply. Is it possible to use aggregate functions inside script?? On Wednesday, May 7, 2014 5:31:20 PM UTC+5:30, Adrien Grand wrote: > Hi, > > There is no way to do it on the Elasticsearch side for the moment. It can > only be done on client side. > > On Wed, May 7, 2014 at 1:37 PM, Alex Mathew \<[alexmathe...@gmail.com](mailto:alexmathe...@gmail.com)\ > > > wrote: > > > How to write an ES query to find the difference between max and min value > > of a field? > > > > I am a newbee in Elasticsearch, In my case I feed lot of events along > > with session\_id and time in to Elasticsearch. My event structure is > > > > Event\_name string > > Client\_id string > > App\_id string > > Session\_id string > > User\_id string > > Ip\_address string > > Latitude int64 > > Longitude int64 > > Event\_time time.Time > > > > I want to find the life time of a session\_id based the feeded events. For that I can retrive the maximum Event\_time and minimum Event\_time for a particular session\_id by the following ES query. > > > > { > > "size": 0, > > "query": { > > "match": { > > "Session\_id": "dummySessionId" > > } > > }, > > "aggs": { > > "max\_time": { > > "max": { > > "field": "Time" > > } > > }, > > "min\_time":{ > > "min": { > > "field": "Time" > > } > > } > > } > > } > > > > But what I exact want is (max\_time - min\_time) How to write the ES query for the same???? > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/1e937884-4052-4a5a-91db-bc1449c43efe%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > Adrien Grand -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/ab72a9e2-60d4-4865-9c71-351b79322f29%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/ab72a9e2-60d4-4865-9c71-351b79322f29%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Alex\_Mathew](https://avatars.discourse-cdn.com/v4/letter/a/76d3ee/32.png) [@Alex\_Mathew](https://discuss.elastic.co/u/Alex_Mathew)\ **Post date:** [May 7, 2014, 12:14pm UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390/4 "2014-05-07T12:14:53Z")
Thank you Adrien Grand for reply. Is it possible to use aggregate functions inside script?? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/c7a1d6a8-1bb7-472c-9be1-7da4d9327e3e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c7a1d6a8-1bb7-472c-9be1-7da4d9327e3e%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\ **Post date:** [May 7, 2014, 1:28pm UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390/5 "2014-05-07T13:28:52Z")
It is not possible either. We are discussing adding more scripting support in order to have the ability to eg. sort based on the delta of two aggregations but it is not clear how feasible it would be or how it could be exposed. On Wed, May 7, 2014 at 2:14 PM, Alex Mathew [alexmathewsenapathy@gmail.com](mailto:alexmathewsenapathy@gmail.com)wrote: > Thank you Adrien Grand for reply. > Is it possible to use aggregate functions inside script?? > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/c7a1d6a8-1bb7-472c-9be1-7da4d9327e3e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c7a1d6a8-1bb7-472c-9be1-7da4d9327e3e%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/c7a1d6a8-1bb7-472c-9be1-7da4d9327e3e%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/c7a1d6a8-1bb7-472c-9be1-7da4d9327e3e%40googlegroups.com?utm_medium=email&utm_source=footer) > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Adrien Grand -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j4tJJFFVWzJ02RhNkURz4b8K\_ivbr-SRoiAChuuThgaJw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j4tJJFFVWzJ02RhNkURz4b8K_ivbr-SRoiAChuuThgaJw%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![nilsga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nilsga/32/482_2.png) [@nilsga](https://discuss.elastic.co/u/nilsga)\ **Post date:** [March 6, 2015, 7:56am UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390/6 "2015-03-06T07:56:59Z")
Has there been any progress on this? Combined with count, It would be a really nice feature for validating the continuity of a dataset based on a strictly incrementing field. Regards, Nils-Helge Garli Hegvik -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/89cb843d-fafe-4a1c-aa82-dea2b8fe48a9%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/89cb843d-fafe-4a1c-aa82-dea2b8fe48a9%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\ **Post date:** [March 6, 2015, 8:31am UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390/7 "2015-03-06T08:31:53Z")
Nothing released yet, but some ongoing experiments on > > > There are many instances where it is useful to perform computations on the outpu…t of aggregations to calculate new aggregations. This meta issue aims to summarize the functionality we would like to add to the aggregations framework to allow different types of computation to be performed during the reduce phase of aggregations. > > This set of new aggregations are the highest priority, given their utility in a wide range of scenarios: > \- \[x\] https://github.com/elasticsearch/elasticsearch/issues/9293 Aggregation to calculate the derivative on a histogram aggregation > \- \[x\] https://github.com/elastic/elasticsearch/pull/10898 Derivative Aggregation x-axis units normalisation > \- \[x\] https://github.com/elasticsearch/elasticsearch/issues/10002 Aggregation to calculate multiple types of moving averages on a histogram aggregation > \- \[x\] https://github.com/elasticsearch/elasticsearch/issues/10000 Aggregation to calculate the bucket which has the maximum value in a given aggregation > \- \[x\] https://github.com/elasticsearch/elasticsearch/issues/9999 Aggregation to calculate the bucket which has the minimum value in a given aggregation > > At the moment, the remainder of the list is largely explorative, to see which ideas/functionality makes sense and have community interest. Feel free to suggest your own ideas/aggregations/algos! > \- \[\] Aggregation that uses scripts to perform arbitrary computations on aggregations > \- \[x\] https://github.com/elastic/elasticsearch/pull/11196 Aggregation to compute differences on a single series (e.g. first difference = Y\t\ - Y\t-1\) > \- \[\] https://github.com/elastic/elasticsearch/pull/10377 Aggs for autocorrelation, acf graphs, correlograms > \- \[x\] https://github.com/elastic/elasticsearch/issues/11006 Aggregation to calculate the (mean) average value of the buckets in a given aggregation > \- \[x\] https://github.com/elastic/elasticsearch/issues/11007 Aggregation to calculate the sum of the values of the buckets in a given aggregation > \- \[x\] https://github.com/elastic/elasticsearch/pull/13128 Aggregation to calculate \`stats\` and \`extended\_stats\` values of the buckets in a given aggregation > \- ~~https://github.com/elastic/elasticsearch/issues/11008 Aggregation to calculate the number of buckets in a given aggregation~~ > \- ~~https://github.com/elastic/elasticsearch/issues/11009 Aggregation to calculate the cardinality of a metric in a given aggregation~~ > \- \[x\] https://github.com/elastic/elasticsearch/issues/11029 Aggregation to allow users to perform simple arithmetic operations on histogram aggregations > \- \[x\] https://github.com/elastic/elasticsearch/pull/11825 Agg to calculate cumulative sum of a metric > \- \[x\] https://github.com/elastic/elasticsearch/pull/11941 Agg to filter buckets based on a script > \- \[x\] https://github.com/elastic/elasticsearch/pull/13186 Agg to calculate percentiles > \- \[\] Agg detect changes in mean (cumulative-sum control chart, Kolmogorov-Smirnov) > \- \[\] Agg detect periodicity, seasonality > \- \[x\] https://github.com/elastic/elasticsearch/pull/11196 Agg to subtract known seasonality (serial differencing) > \- \[\] Agg for regression > \- \[\] Agg for Savitzky-Golay Filters > \- \[\] Aggs for high-pass, low-pass, band-pass filters > \- \[\] Agg for generic FFT and inverse FFT > \- \[\] https://github.com/elastic/elasticsearch/issues/14928 Agg for selecting the \`nth\` bucket, and/or selecting a range + truncating > \- \[\] Agg for building a sliding\_histogram On Fri, Mar 6, 2015 at 8:56 AM, [nilsga@gmail.com](mailto:nilsga@gmail.com) wrote: > Has there been any progress on this? Combined with count, It would be a > really nice feature for validating the continuity of a dataset based on a > strictly incrementing field. > > Regards, > > Nils-Helge Garli Hegvik > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/89cb843d-fafe-4a1c-aa82-dea2b8fe48a9%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/89cb843d-fafe-4a1c-aa82-dea2b8fe48a9%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/89cb843d-fafe-4a1c-aa82-dea2b8fe48a9%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/89cb843d-fafe-4a1c-aa82-dea2b8fe48a9%40googlegroups.com?utm_medium=email&utm_source=footer) > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Adrien Grand -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j468GKz%3DHYv7PHx%2BZ%2BhVPGQLVnz5Cmesr-zG%2B5jKFQu%3DQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j468GKz%3DHYv7PHx%2BZ%2BhVPGQLVnz5Cmesr-zG%2B5jKFQu%3DQ%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:28am UTC](https://discuss.elastic.co/t/how-to-find-the-difference-between-aggregate-min-from-aggregate-max-max-min-in-es/17390/8 "2017-07-06T00:28:09Z")