Kibana "Logs" application Tiebreaker field grayed out

Elastic Stack Kibana
5

To give you an example, I set the "context:tieBreakerFields" value in Kibana's advanced settings to "event.sequence,_doc" (That field is set by logstash and I can see it arrive in the Discoverer app).

  1. The original log would look like this:
[2020-04-17 11:16:36.874] [123] [My 1st log entry]
[2020-04-17 11:16:36.874] [456] [My 2nd log entry]
[2020-04-17 11:16:36.874] [789] [My 3rd log entry]

  1. filebeat sends the logs to Logstash

  2. Logstash does some mangling, including setting the "event.sequence" field to the value of the second set of brackets:

i.e. event.sequence => 123

  1. Logstash sends new event to Elasticsearch

  2. The Discover app shows the fields out of order, such as:

Apr 17, 2020 @ 11:16:36.874    123
Apr 17, 2020 @ 11:16:36.874    789
Apr 17, 2020 @ 11:16:36.874    456
  1. If I go into the Log apps, the log entries are also in the wrong order. To come back to my original port, the tiebreaker field in the Logs settings in grayed out, and using the value "
xpack.infra.sources.default.fields.tiebreaker: 'event.sequence'

... in kibana.yml does nothing to help.

Joey