How to get maximum value of field in events?

[Saket_Kumar]

I have two entries of message event, which has two array fields i have to find out maximum length of these array.

Is there any ways.?

[magnusbaeck (Magnus Bäck)]

Do you want to find the maximum value of the elements of the array and store that value into a field (either by overwriting the array field or creating a new field), or are you talking about an Elasticsearch query? In the former case you'll probably have to use the ruby filter and write a small Ruby snippet.

[Saket_Kumar]

@magnusbaeck

find the maximum value of the elements of the array and store that value into a field (either by overwriting the array field or creating a new field.

Yes want to find the maximum value of the elements of the array and store that value into a field (either by overwriting the array field or creating a new field.

[magnusbaeck (Magnus Bäck)]

Well, you seem to be on the right track given your other post (below). Please try to keep related questions together.

"hash=event['field'].to_hash" instead "hash = event.to_hash"

Is it possible... I want to traverse through events against specific field. something like: hash = event['field1'].to_hash hash.each { |event['field1'], v| puts event['field1'] if v == hash.values.max } Any help?

[Saket_Kumar]

Sure .

Thanks for your help!