Is there way to sort graphs in visualization?

Hi.

I have a heatmap in one visualization. I have 3 sources, so I split chart by column by source, which creates 3 heatmaps. Let's say source A, B, and C.

Currently, order is A,B,C. I can change using Order, but it only has ascending and descending. Is there way to sort them anyway I want to? For example, I want to see graph in order of B, A and C.

If I understand correctly you can do this with a scripted field.

You would create a new numeric field based on your source (A, B, C). Assign new values like below.

Now in your visualization you would sort by vis_order.

1 Like

So I have to modify index pattern in order to sort them?

It's one way to do this. You are adding to the index pattern on the fly and not really modifying it.

This new field only is calculated when the visualization loads. At runtime the values are generated.

1 Like

Hi,

Thanks for helping me. I added Scripted Field and added vis_order. I checked logs and source A,B, and C has vis_order with assigned number.

However, when I try to sort them in visualization, it doesn't work. For my pie chart, I go to Bucket -> Split chart -> Order by and tried different options. I found Unique Count but it doesn't work. Can you please help me to sort A,B,C using scripted field in visualization?

This is due to the values of the scripted fields are being generated while the data is being inserted.

Say you have 100k records in this index. It would have to process all 100k records to add the scripted field first before able to do a sort on them. All that to say I was incorrect and you can't sort by a scripted field.

What you need to do now is to process this new field during ingestion using Logstash, Beats, or an Ingestion Pipeline to add this new field. That way it's calculated one time and you can sort on the finished field.

1 Like

So I need to add the field when I actually log them with other field in my java code right?

Correct. Create a new field to sort on before the data is ingested.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.