# Discovery, sort by timestamp and then field (int)

**URL:** <https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770>\
**Category:** Kibana\
**Created:** [March 20, 2018, 1:23pm UTC](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770 "2018-03-20T13:23:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![elvarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elvarb/32/44840_2.png) [@elvarb](https://discuss.elastic.co/u/elvarb)\
**Post date:** [March 20, 2018, 1:23pm UTC](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770/1 "2018-03-20T13:23:21Z")

</div>

I have logs that come in that are only accurate down to a second.

The logs are generated when different part of an application is run, so when a function is run it has a unique ID to group those messages together and there is also an incremental int field for ordering. The issue is that there can be multiple lines each second and since Kibana discovery is only order on timestamps the line numbers are often out of order.

Is it possible to do order by (timestamp, line\_no) ?

---

<div class="post-metadata">

**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\
**Post date:** [March 20, 2018, 2:24pm UTC](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770/2 "2018-03-20T14:24:13Z")

</div>

Hi Elvar,

currently that is unfortunately not possible. We have an open feature request [#696](https://github.com/elastic/kibana/issues/696) for that, that you can follow to stay informed about updates.

A workaround could be, to index the timestamp + the unique ID suffixed that way you have both in one field to sort for them.

Cheers,  
Tim

---

<div class="post-metadata">

**Author:** ![elvarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elvarb/32/44840_2.png) [@elvarb](https://discuss.elastic.co/u/elvarb)\
**Post date:** [March 20, 2018, 2:31pm UTC](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770/3 "2018-03-20T14:31:26Z")

</div>

I hacked this differently, the line\_no field rarely goes over 10, but sometimes it goes over 12000.

Used the ruby filter to create a new string field with 3 numbers, always

```
ruby {
   	code => "event.set('line_ns', event.get('line_no').to_s.rjust(3, '0')[-3..-1])"
}

```

So line\_no field of 1 becomes 001, and line\_no field of 12034 becomes 034. Then I combined the timestamp field in the log with the new line\_no field, that way I could parse it so that the line\_no becomes the nanoseconds.

```
mutate {
	add_field => { "timestamp_line" => "%{timestamp} %{line_ns}" }
}

date {
	match => ["timestamp_line", "dd.MM.yyyy HH:mm:ss SSS"]
}

```

The only risk is when events come in on the same second and it moves from 999 to 1000, very very unlikely.

Using your method of creating a new field I dont think I would be able to sort it in the Discovery panel, seem to be only be able to sort by timestamp and int, not strings.

---

<div class="post-metadata">

**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\
**Post date:** [March 20, 2018, 2:34pm UTC](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770/4 "2018-03-20T14:34:02Z")

</div>

That's correct (regarding the sortability). But why don't you just join those two numeric values into another numeric value? As long as you make sure, that you use the same amount of digits for the `line_ns` which you do, you can just place them behind of each other and treat them as a new numeric value and index it as a long?

---

<div class="post-metadata">

**Author:** ![elvarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elvarb/32/44840_2.png) [@elvarb](https://discuss.elastic.co/u/elvarb)\
**Post date:** [March 20, 2018, 2:41pm UTC](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770/5 "2018-03-20T14:41:56Z")

</div>

Because each log has a unique log\_id, and within each log\_id are multiple entries with line\_no, each starting from 1 to some number.

... though... there is another field called uix\_seq\_no which is auto increment it seems, 🙂 seems to be the most obvious to use that. I'm just not sure about the actual behavior of that field, does it grow during the lifetime of the system, does it reset with version upgrades, or with reboots or something else.

For now I'll use the timestamp, when I'm sure about the uix\_seq\_no field I'll shift to that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2018, 2:41pm UTC](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770/6 "2018-04-17T14:41:59Z")

</div>

Closed on April 17, 2018, 2:41pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.