# Store max value of a metric in a week in elasticsearch

**URL:** <https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209>\
**Category:** Elasticsearch\
**Created:** [June 2, 2022, 9:17am UTC](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209 "2022-06-02T09:17:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![S-elk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s-elk/32/98464_2.png) [@S-elk](https://discuss.elastic.co/u/S-elk)\
**Post date:** [June 2, 2022, 9:17am UTC](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209/1 "2022-06-02T09:17:57Z")

</div>

Hello!

I am currently collecting the metrics of certain services and I am interested in storing the maximum value of a week. I know how to do it with the tsvb visualization but I don't know how to store it in the elastic docs. is there any way to do it ? via scripted field or logstash ? It would be of great help

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 2, 2022, 11:20pm UTC](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209/2 "2022-06-02T23:20:31Z")

</div>

If you can read that value from Elasticsearch using Kibana, then isn't it already stored in a document in Elasticsearch?

It's not clear what else you are trying to do sorry.

---

<div class="post-metadata">

**Author:** ![S-elk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s-elk/32/98464_2.png) [@S-elk](https://discuss.elastic.co/u/S-elk)\
**Post date:** [June 3, 2022, 7:36am UTC](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209/3 "2022-06-03T07:36:41Z")

</div>

I am trying to get the maximum and minimum value of a metric in a week. I am trying to run this query via logstash but it just creates a lot of empty records.

```auto
  {
  "size" : 0,
  "query" : {
    "bool" : {
      "must" : [
        {
          "term" : {
            "Metric-Type.keyword" : {
              "value" : "avg-host-cpu-load",
              "boost" : 1.0
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "now-7d",
              "lte": "now"
            }
          }
        }
      ],
      "adjust_pure_negative" : true,
      "boost" : 1.0
    }
  },
  "_source" : false,
  "aggregations" : {
    "groupby" : {
      "filters" : {
        "filters" : [
          {
            "match_all" : {
              "boost" : 1.0
            }
          }
        ],
        "other_bucket" : false,
        "other_bucket_key" : "_other_"
      },
      "aggregations" : {
        "ca3b8a9e" : {
          "stats" : {
            "field" : "ValueMetric"
          }
        }
      }
    }
  }
}

```

Then I tried to execute this curl in many different ways, but in all of them it gives syntax errors.

```auto
input {
  exec {
    command => "curl xxxx -XPOST https://yyyyyy:9200/_sql -H 'Content-Type: application/json' -d'
{
  \"query\":\" SELECT MIN(ValueMetric) as MinValueMetric , MAX(ValueMetric) as MaxValueMetric FROM \"i-service-metric\" WHERE \"Metric-Type\"= 'service-response-time' AND \"@timestamp\" >= NOW() - INTERVAL 7 DAY\"

}'
"
    interval => 30
  }
}

```

as I can't get any way, I wanted to know if there is any other way to do this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2022, 7:37am UTC](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209/4 "2022-07-01T07:37:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.