Array of dates always sorts ascending in Kibana Discovery Query results


#1

I have documents which contain an ES login-history field, and the ES documents have the login history in reverse chronological order. The problem I have is that Kibana always presents the dates in ascending order when if the date field is in the selected query attributes, or in the 'Table' view of a record. If I click the JSON view things look fine, e.g.:

"login-history": [
1464884262941,
1464877491523,
1464876396375,
1464802504594,
1464276153017,
1464275650052,
1464275616108,
1464275192750,
1464270502451,
1464201004285
]

But when printed any other way in query results (TABLE record view, query results), they appear this way:

May 25th 2016, 14:30:04.285, May 26th 2016, 09:48:22.451, May 26th 2016, 11:06:32.750, May 26th 2016, 11:13:36.108, May 26th 2016, 11:14:10.052, May 26th 2016, 11:22:33.017, June 1st 2016, 13:35:04.594, June 2nd 2016, 10:06:36.375, June 2nd 2016, 10:24:51.523, June 2nd 2016, 12:17:42.941

How can I get Kibana (Version 4.5) to present the data as it is ordered in the record instead of reordering the data when it formats the dates?


(Tim Sullivan) #2

I can reproduce this with this data, that I set up in Sense:

PUT /bullwinkle
{
  "settings": {
    "number_of_replicas": 0,
    "number_of_shards": 1
  }
}

PUT /bullwinkle/type1/_mapping
{
  "properties": {
    "name": {
      "type": "string"
    },
    "login_history": {
      "type": "date"
    }
  }
}

// login_history reverse order
POST /bullwinkle/type1/1
{
  "name": "First post",
  "login_history": [
    1464884262941,
    1464877491523,
    1464876396375,
    1464802504594,
    1464276153017,
    1464275650052,
    1464275616108,
    1464275192750,
    1464270502451,
    1464201004285
  ]
}

// _source has the login_history values in the right order
GET /bullwinkle/type1/1

And Kibana shows the array data sorted when it's displayed in the doc table. It doesn't seem to matter what the mapping for the login_history field is, and there doesn't seem to be any place in Advanced settings that can control this.

This is odd behavior, it might be a bug. I see this happen in Kibana 4.x and Kibana 5.


(system) #3