# How to get maximum value of field in events?

**URL:** <https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167>\
**Category:** Logstash\
**Created:** [June 23, 2015, 9:22am UTC](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167 "2015-06-23T09:22:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [June 23, 2015, 9:22am UTC](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167/1 "2015-06-23T09:22:23Z")

</div>

I have two entries of message event, which has two array fields i have to find out maximum length of these array.

Is there any ways.?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 23, 2015, 9:47am UTC](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167/2 "2015-06-23T09:47:29Z")

</div>

Do you want to find the maximum value of the elements of the array and store that value into a field (either by overwriting the array field or creating a new field), or are you talking about an Elasticsearch query? In the former case you'll probably have to use the [ruby filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html) and write a small Ruby snippet.

---

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [June 23, 2015, 9:50am UTC](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167/3 "2015-06-23T09:50:54Z")

</div>

> [@magnusbaeck](#):
>
> find the maximum value of the elements of the array and store that value into a field (either by overwriting the array field or creating a new field.

Yes want to find the maximum value of the elements of the array and store that value into a field (either by overwriting the array field or creating a new field.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 23, 2015, 10:09am UTC](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167/4 "2015-06-23T10:09:57Z")

</div>

Well, you seem to be on the right track given your other post (below). Please try to keep related questions together.

> [@"hash=event\['field'\].to\_hash" instead "hash = event.to\_hash"](https://discuss.elastic.co/t/hash-event-field-to-hash-instead-hash-event-to-hash/24169):
>
> Is it possible... I want to traverse through events against specific field. something like: hash = event['field1'].to\_hash hash.each { |event['field1'], v| puts event['field1'] if v == hash.values.max } Any help?

---

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [June 23, 2015, 10:12am UTC](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167/5 "2015-06-23T10:12:31Z")

</div>

Sure .

Thanks for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167/6 "2017-07-06T05:36:44Z")

</div>