# Kibana "Logs" application Tiebreaker field grayed out

**URL:** https://discuss.elastic.co/t/kibana-logs-application-tiebreaker-field-grayed-out/228375
**Category:** Kibana
**Created:** [April 16, 2020, 5:01pm UTC](https://discuss.elastic.co/t/kibana-logs-application-tiebreaker-field-grayed-out/228375 "2020-04-16T17:01:23Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![cotjoey](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@cotjoey](https://discuss.elastic.co/u/cotjoey)
#### Post date: [April 22, 2020, 12:54pm UTC](https://discuss.elastic.co/t/kibana-logs-application-tiebreaker-field-grayed-out/228375/5 "2020-04-22T12:54:08Z")

</div>

To give you an example, I set the "context:tieBreakerFields" value in Kibana's advanced settings to "event.sequence,\_doc" (That field is set by logstash and I can see it arrive in the Discoverer app).

1. The original log would look like this:

```auto
[2020-04-17 11:16:36.874] [123] [My 1st log entry]
[2020-04-17 11:16:36.874] [456] [My 2nd log entry]
[2020-04-17 11:16:36.874] [789] [My 3rd log entry]

```

1. filebeat sends the logs to Logstash

2. Logstash does some mangling, including setting the "event.sequence" field to the value of the second set of brackets:

```auto
i.e. event.sequence => 123

```

1. Logstash sends new event to Elasticsearch

2. The Discover app shows the fields out of order, such as:

```auto
Apr 17, 2020 @ 11:16:36.874 123
Apr 17, 2020 @ 11:16:36.874 789
Apr 17, 2020 @ 11:16:36.874 456

```

1. If I go into the Log apps, the log entries are also in the wrong order. To come back to my original port, the tiebreaker field in the Logs settings in grayed out, and using the value "

```auto
xpack.infra.sources.default.fields.tiebreaker: 'event.sequence'

```

... in kibana.yml does nothing to help.

Joey

---

_[View the full topic](https://discuss.elastic.co/t/kibana-logs-application-tiebreaker-field-grayed-out/228375)._