# Summing up max values

**URL:** <https://discuss.elastic.co/t/summing-up-max-values/110629>\
**Category:** Kibana\
**Created:** [December 7, 2017, 8:36am UTC](https://discuss.elastic.co/t/summing-up-max-values/110629 "2017-12-07T08:36:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![emil.mirzayev](https://avatars.discourse-cdn.com/v4/letter/e/ba9def/32.png) [@emil.mirzayev](https://discuss.elastic.co/u/emil.mirzayev)\
**Post date:** [December 7, 2017, 8:36am UTC](https://discuss.elastic.co/t/summing-up-max-values/110629/1 "2017-12-07T08:36:14Z")

</div>

Hi. I have a dataset of measurements of different devices by time. Every time period, measurements for every device increases. My data structure is:

```
timestamp, meter_id, value;
timestamp, another_meter_id, value;
timestamp + t, meter_id, some_new_value;
timestamp + t, another_meter_id, some_new_value;
.......
timestamp + n, meter_id, some_new_value;
timestamp + n , another_meter_id, some_new_value.

```

If I am doing this query on timelion:`.es(index = index_name, timefield = timestamp, metric = max:value, q = meter_id)` it works for one meter. Because it is filtered to one meter, sum or max aggregation do the same thing.

What I want to do is, to sum up all MAX values of all devices (meter 1, meter 2, meter 3.. meter n) for every timestamp. Because values are gradually increasing, I am interested in seeing the graph of these summed values by time on timelion. Is it possible?

---

<div class="post-metadata">

**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\
**Post date:** [December 8, 2017, 2:40pm UTC](https://discuss.elastic.co/t/summing-up-max-values/110629/2 "2017-12-08T14:40:58Z")

</div>

Hi Emil,

I am not sure, which of these two versions you want, but both should work rather fine:

If you want to have separate lines, each line representing the max value of one meter, you can use the following expression (shortened for index and timefield):

```auto
.es(metric=max:value, split=meter_id_field:5)

```

In that case you would get 5 lines for each of the top meters (indicated by the `meter_id_field`, and their respective max values.

If you want to have like the maximum value per meter in each timeslot and THAN have the sum of all of those, you can basically put the above expression into a `.sum` function:

```auto
.sum(.es(metric=max:value, split=meter_id_field:5))

```

You will need to change the 5 to something, that is high enough to include all your meters.

Cheers,  
Tim

---

<div class="post-metadata">

**Author:** ![emil.mirzayev](https://avatars.discourse-cdn.com/v4/letter/e/ba9def/32.png) [@emil.mirzayev](https://discuss.elastic.co/u/emil.mirzayev)\
**Post date:** [December 11, 2017, 12:49pm UTC](https://discuss.elastic.co/t/summing-up-max-values/110629/3 "2017-12-11T12:49:23Z")

</div>

Hi Tim,

thank you for your reply. It was very helpful and solved my question!

As a side quest, i wonder would it be possible to split also without specifying the top-n number for the groups? If my device number is increasing constantly at unpredicted level, how I proceed then?

best,  
Emil

---

<div class="post-metadata">

**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\
**Post date:** [December 12, 2017, 7:59am UTC](https://discuss.elastic.co/t/summing-up-max-values/110629/4 "2017-12-12T07:59:27Z")

</div>

Hi Emil,

this is unfortunately not possible. The second parameter is required and will be passed to the size parameter of the terms aggregation in Elasticsearch doing the splitting.

Cheers,  
Tim

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2018, 7:59am UTC](https://discuss.elastic.co/t/summing-up-max-values/110629/5 "2018-01-09T07:59:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.