# Change the return order

**URL:** <https://discuss.elastic.co/t/change-the-return-order/104851>\
**Category:** Elasticsearch\
**Created:** [October 23, 2017, 7:46am UTC](https://discuss.elastic.co/t/change-the-return-order/104851 "2017-10-23T07:46:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [October 23, 2017, 7:46am UTC](https://discuss.elastic.co/t/change-the-return-order/104851/1 "2017-10-23T07:46:38Z")

</div>

this is one of return data:  
{  
"\_index": "ntopng-2017.10.22",  
"\_type": "ntopng",  
"\_id": "AV9Ef4XlWkHrd\_Wf01w6",  
"\_score": 3,  
"\_source": {  
"L7\_PROTO\_NAME": "SSL",  
"L4\_DST\_PORT": 443,  
"IPV4\_SRC\_ADDR": "120.127.163.189",  
"IN\_PKTS": 17,  
"IN\_BYTES": 1254,  
"LAST\_SWITCHED": 1508682662,  
"OUT\_PKTS": 14,  
"IPV4\_DST\_ADDR": "203.104.153.1",  
"OUT\_BYTES": 4295,  
"FIRST\_SWITCHED": 1508682661  
}  
could I change its order (such as ASII)  
like this  
{  
"\_index": "ntopng-2017.10.22",  
"\_type": "ntopng",  
"\_id": "AV9Ef4XlWkHrd\_Wf01w6",  
"\_score": 3,  
"\_source": {  
"L7\_PROTO\_NAME": "SSL",  
"L4\_DST\_PORT": 443,  
"IPV4\_DST\_ADDR": "203.104.153.1",  
"IPV4\_SRC\_ADDR": "120.127.163.189",  
"IN\_PKTS": 17,  
"IN\_BYTES": 1254,  
"OUT\_PKTS": 14,  
"OUT\_BYTES": 4295,  
"FIRST\_SWITCHED": 1508682661,  
"LAST\_SWITCHED": 1508682662

}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 23, 2017, 8:51am UTC](https://discuss.elastic.co/t/change-the-return-order/104851/2 "2017-10-23T08:51:38Z")

</div>

the order of the source is based on how it is indexed, elasticsearch does not modify it (unless you use pipelines).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2017, 8:52am UTC](https://discuss.elastic.co/t/change-the-return-order/104851/3 "2017-11-20T08:52:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.