# Elasticsearch SQL ORDER BY Month

**URL:** https://discuss.elastic.co/t/elasticsearch-sql-order-by-month/256716
**Category:** Elasticsearch
**Tags:** elastic-stack-sql
**Created:** [November 25, 2020, 10:00pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-order-by-month/256716 "2020-11-25T22:00:02Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [December 16, 2020, 6:18pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-order-by-month/256716/6 "2020-12-16T18:18:48Z")

</div>

Thanks @bogdan.pintea for your answer.

The data preview seems perfect:

![image](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f381b2a9934d5f564ba6f37600e7accf0fbeaa26.png)

But I'm having some troubles configuring the graph when I don't use as 'AS', seems something wrong with using "@timestamp".

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/1/01f68b58816c75693ea0da859c339a9e49cb4267.png)

So tried with 'AS':

```
SELECT COUNT(DISTINCT user.name) AS UniqueUsers, DATETIME_FORMAT("@timestamp", 'MMM') AS Month
FROM "nagios" 
WHERE "@timestamp" > now() - interval 1 years AND event.dataset LIKE 'nagios.audit' AND MATCH(message,'Logged in')
GROUP BY DATETIME_FORMAT("@timestamp", 'yyyy-LL'), 2

```

Which produces:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4d7523fce39f0a16e60b5a023a3882b95ebc437b.png)

But this is also ordered alphabetically..

So it seems to result in the same issue using "GROUP BY Month, MonthNumber".

Willem

---

_[View the full topic](https://discuss.elastic.co/t/elasticsearch-sql-order-by-month/256716)._