To give you an example, I set the "context:tieBreakerFields" value in Kibana's advanced settings to "event.sequence,_doc" (That field is set by logstash and I can see it arrive in the Discoverer app).
- The original log would look like this:
[2020-04-17 11:16:36.874]  [My 1st log entry]
[2020-04-17 11:16:36.874]  [My 2nd log entry]
[2020-04-17 11:16:36.874]  [My 3rd log entry]
filebeat sends the logs to Logstash
Logstash does some mangling, including setting the "event.sequence" field to the value of the second set of brackets:
i.e. event.sequence => 123
Logstash sends new event to Elasticsearch
The Discover app shows the fields out of order, such as:
Apr 17, 2020 @ 11:16:36.874 123
Apr 17, 2020 @ 11:16:36.874 789
Apr 17, 2020 @ 11:16:36.874 456
- If I go into the Log apps, the log entries are also in the wrong order. To come back to my original port, the tiebreaker field in the Logs settings in grayed out, and using the value "
... in kibana.yml does nothing to help.