# Discover Menu in Kibana no more sorting by index

**URL:** <https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592>\
**Category:** Kibana\
**Created:** [May 30, 2017, 3:29pm UTC](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592 "2017-05-30T15:29:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![AurelieP](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@AurelieP](https://discuss.elastic.co/u/AurelieP)\
**Post date:** [May 30, 2017, 3:29pm UTC](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592/1 "2017-05-30T15:29:44Z")

</div>

Hello,

I'm currently using Kibana with Fluentd and Metricbeats.  
I have 2 indexes : logstash-\* and metricbeat-\*

In the Discover menu of Kibana, I have the choice to sort the results by index, but this is not working anymore. I mean, if I chose logstash, I have result from logstash and from metricbeats.  
I've try to restart Kibana/Elasticsearch.  
I have remove all the indexes to restart from scratch.  
I've also check in the Management/Index Patterns and they are both well defined. In the Discover menu, I can check and see that the results have the right index.  
When I choose logstash index, I can see in the Available Fields, the ones from metricbeats and it's the same if I choose metricbeats index.

Any idea where it's coming from ?  
I have no errors or nothing strange in Kibana's logs

Thank you,  
Best Regards,  
Aurelie

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [May 30, 2017, 10:18pm UTC](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592/2 "2017-05-30T22:18:33Z")

</div>

So, you have both index patterns defined in Kibana, and you're saying that you choose the `logstash-*` pattern on the sidebar, like so:

![](https://us1.discourse-cdn.com/elastic/original/3X/9/5/95710e2b723ff4dcc385dcc9580011b835a54231.png)

But, in the documents that are shown below the chart, you see are seeing documents from the metricbeat index?

---

<div class="post-metadata">

**Author:** ![AurelieP](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@AurelieP](https://discuss.elastic.co/u/AurelieP)\
**Post date:** [May 31, 2017, 7:46am UTC](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592/3 "2017-05-31T07:46:41Z")

</div>

Hello,

Yes, for example if I choose logstash-\* pattern on the sidebar, I'm going to see documents from logstash index and from metricbeat index.

Moreover, in the side bar, I can see the fields for metricbeat in the logstash index as unknow, like this :  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/b/a/baff672d26cbf7c7a34477971b60f63975982b8f.png)  
It's normal that it's unknow because they are not defined in the definition of the logstash index (I've checked). They should just not be there.

Thank you for your help,  
Aurelie

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [June 1, 2017, 4:49pm UTC](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592/4 "2017-06-01T16:49:34Z")

</div>

Wow, very strange. Does refreshing the fields in _Management \> Index Patterns_ help?

It sounds like you've looked at [the field mappings] you have in `logstash-*` indices, but just so I'm clear, if you do, you don't see the beats fields, right?

Also, what version of the stack are you running?

---

<div class="post-metadata">

**Author:** ![AurelieP](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@AurelieP](https://discuss.elastic.co/u/AurelieP)\
**Post date:** [June 2, 2017, 7:09am UTC](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592/5 "2017-06-02T07:09:22Z")

</div>

Yes that's very strange !  
I've done refreshment of the fields a couple times; but it doesn't change anything.  
My logstash index is defined as default index, by the way.

Yes in the field mapping of logstash, I don't see the beats fields, and in the field mapping of metricbeats, I don't see the logstash fields. Everything seems right there.

I'm running the 5.2.2 version of the stack and the all stack have the same version.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2017, 7:09am UTC](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592/6 "2017-06-30T07:09:49Z")

</div>

Closed on June 30, 2017, 7:09am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
