# Default behavior of sorting in the transform

**URL:** <https://discuss.elastic.co/t/default-behavior-of-sorting-in-the-transform/366729>\
**Category:** Elasticsearch\
**Created:** [September 18, 2024, 11:18am UTC](https://discuss.elastic.co/t/default-behavior-of-sorting-in-the-transform/366729 "2024-09-18T11:18:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![prashant1](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@prashant1](https://discuss.elastic.co/u/prashant1)\
**Post date:** [September 18, 2024, 11:18am UTC](https://discuss.elastic.co/t/default-behavior-of-sorting-in-the-transform/366729/1 "2024-09-18T11:18:27Z")

</div>

We are using transform and doing sorting based in extractDateTime. We want to know if we two logs available with the exact same extractDateTime value. Then based on which behavior it will show the log.

Or is it random it can show any of the log?

---

<div class="post-metadata">

**Author:** ![Alex\_Salgado-Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_salgado-elastic/32/103081_2.png) [@Alex\_Salgado-Elastic](https://discuss.elastic.co/u/Alex_Salgado-Elastic)\
**Post date:** [September 18, 2024, 1:37pm UTC](https://discuss.elastic.co/t/default-behavior-of-sorting-in-the-transform/366729/2 "2024-09-18T13:37:55Z")

</div>

Hi @prashant1

If applicable, you can select or create a secondary field to use as a tie-breaker criterion. By default, when multiple documents have the same value for a sort field, Elasticsearch falls back to sorting by the internal order of insertion. To avoid this and ensure consistent results, you can use a secondary field for sorting. For example:

```auto
GET /logs_example/_search
{
  "sort": [
    { "extractDateTime": { "order": "desc" } },
    { "status.keyword": { "order": "asc" } }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![prashant1](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@prashant1](https://discuss.elastic.co/u/prashant1)\
**Post date:** [September 18, 2024, 3:50pm UTC](https://discuss.elastic.co/t/default-behavior-of-sorting-in-the-transform/366729/3 "2024-09-18T15:50:43Z")

</div>

Hi @Alex_Salgado-Elastic  
Thanks for the response.

But can it be possible to use two sort fields inside the transform? I think it supports only one sort field in the transform.  
We have tried by using two fields as sort but got the below error

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "x_content_parse_exception",
        "reason": "Failed to build [top_metrics] after last required field arrived"
      }
    ],
    "type": "x_content_parse_exception",
    "reason": "[1:2418] [data_frame_transform_config] failed to parse field [pivot]",
    "caused_by": {
      "type": "x_content_parse_exception",
      "reason": "[1:2418] [data_frame_transform_pivot] failed to parse field [aggregations]",
      "caused_by": {
        "type": "x_content_parse_exception",
        "reason": "Failed to build [top_metrics] after last required field arrived",
        "caused_by": {
          "type": "illegal_argument_exception",
          "reason": "[sort] must contain exactly one sort"
        }
      }
    }
  },
  "status": 400
}

```