# Elasticsearch filter plugin not sorting properly
**URL:** https://discuss.elastic.co/t/elasticsearch-filter-plugin-not-sorting-properly/181045
**Category:** Logstash
**Created:** [May 14, 2019, 5:02pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-not-sorting-properly/181045 "2019-05-14T17:02:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Kagerou](https://discuss.elastic.co/u/Kagerou)
#### Post date: [May 14, 2019, 5:02pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-not-sorting-properly/181045/1 "2019-05-14T17:02:06Z")
I'm currently using the elasticsearch filter plugin to search for documents I have in elasticsearch.
a snippet of my config file:
> query =\> "messageContent:offline, alert AND senderID:%{[senderID]}"
> sort =\> "@timestamp:desc"
Alert is the first document inserted and it's only done once. All the documents following it are offline.
When I apply the timestamp:desc sort however, alert is the first document to appear. When I take it out of the query it pulls the latest offline document. Also if I switch the code from
> query =\> "messageContent:offline, alert AND senderID:%{[senderID]}"
to
> query =\> "messageContent:alert, offline AND senderID:%{[senderID]}"
It works properly. Any suggestions to fix this issue?
---
### Author:  [@Kagerou](https://discuss.elastic.co/u/Kagerou)
#### Post date: [May 14, 2019, 6:41pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-not-sorting-properly/181045/2 "2019-05-14T18:41:14Z")
This can be closed. I needed to change the query from
> "messageContent:offline, alert AND senderID"
to
> "messageContent:(offline OR alert) AND senderID
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 11, 2019, 6:41pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-not-sorting-properly/181045/3 "2019-06-11T18:41:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.