For a test, I inserted 1000 docs into elasticsearch index. One column has a consecutive number (3. column in the screen shot). This column is sorted ascending in Kibana. After the 253. row Kibana breaks the order and shows me a number that is less than the previous one and not at the beginning. I tested this issue in Kibana 7.7.0 and 7.7.1. The third column is a number in the index patterns. (Sorry in the screen shot you can't see the column header, thats the reason that I described it as 3. column).
@jbeyer - can you post a couple of example documents? It would also be helpful to get the index mapping - https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html
Hi mattkime, first hier is the index mapping:
"testjb-2020.06.16-01" : {
"mappings" : {
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "basic_date_time"
},
"app" : {
"type" : "keyword"
},
"instance" : {
"type" : "keyword"
},
"level" : {
"type" : "keyword"
},
"message" : {
"type" : "text"
},
"orderTicks" : {
"type" : "keyword"
},
"orderTicksShort" : {
"type" : "long"
},
"threadId" : {
"type" : "keyword"
}
}
}
}
} ´´´
The column that I sorted is "orderTicksShort".And hier the sample documents (2 befor the sorting failure and 2 after):
{
"_index" : "testjb-2020.06.16-01",
"_type" : "_doc",
"_id" : "SLZwvHIBfGd7M5axiLJB",
"_version" : 1,
"_seq_no" : 999,
"_primary_term" : 1,
"found" : true,
"_source" : {
"message" : "(Info) Lorem ipsum dolor sit 'amet', consetetur sadipscing elitr, ",
"@timestamp" : "20200616T112307.772+02:00",
"orderTicks" : "14466187772:0252",
"orderTicksShort" : "3703344069884",
"threadId" : "1",
"level" : "INFO",
"app" : "Application",
"instance" : "LogDemoAppHost"
}
}
{
"_index" : "testjb-2020.06.16-01",
"_type" : "_doc",
"_id" : "SbZwvHIBfGd7M5axiLJB",
"_version" : 1,
"_seq_no" : 1000,
"_primary_term" : 1,
"found" : true,
"_source" : {
"message" : "(Info) Lorem ipsum dolor sit 'amet', consetetur sadipscing elitr, ",
"@timestamp" : "20200616T112307.772+02:00",
"orderTicks" : "14466187772:0253",
"orderTicksShort" : "3703344069885",
"threadId" : "1",
"level" : "INFO",
"app" : "Application",
"instance" : "LogDemoAppHost"
}
}
{
"_index" : "testjb-2020.06.16-01",
"_type" : "_doc",
"_id" : "srZwvHIBfGd7M5axiK9B",
"_version" : 1,
"_seq_no" : 337,
"_primary_term" : 1,
"found" : true,
"_source" : {
"message" : "(Info) Lorem ipsum dolor sit 'amet', consetetur sadipscing elitr, ",
"@timestamp" : "20200616T112307.771+02:00",
"orderTicks" : "14466187771:0238",
"orderTicksShort" : "3703344069614",
"threadId" : "1",
"level" : "INFO",
"app" : "Application",
"instance" : "LogDemoAppHost"
}
}
{
"_index" : "testjb-2020.06.16-01",
"_type" : "_doc",
"_id" : "s7ZwvHIBfGd7M5axiK9B",
"_version" : 1,
"_seq_no" : 338,
"_primary_term" : 1,
"found" : true,
"_source" : {
"message" : "(Info) Lorem ipsum dolor sit 'amet', consetetur sadipscing elitr, ",
"@timestamp" : "20200616T112307.771+02:00",
"orderTicks" : "14466187771:0239",
"orderTicksShort" : "3703344069615",
"threadId" : "1",
"level" : "INFO",
"app" : "Application",
"instance" : "LogDemoAppHost"
}
}
Which view in kibana are you looking at?
Hi, it is the "Discover" - View or tab from the left side bar and I added the "Available fields", that I need to show.
Could you provide screenshots of the column headers? Do you have any search or filter criteria in the search bar?
It might also be helpful to take a look at the request and response being send to elasticsearch via the browser console.
Hi, I found the reason of the issue: If I click the the sort triangle on the column "orderTicksShort" for sorting ascending than on column "Time" there is also the sort triangle set for sorting descending. Thats the default if I start Discovery. I was thinking, if I click the sorting on a column, than the sorting on the other column stops. But it isn't. If only sorting on the column "orderTicksShort" is active, than it sorts right.
