# Need update on tiebreaker fields for Kibana logs (event.sequence ?)

**URL:** <https://discuss.elastic.co/t/need-update-on-tiebreaker-fields-for-kibana-logs-event-sequence/273295>\
**Category:** Logs\
**Created:** [May 18, 2021, 1:42pm UTC](https://discuss.elastic.co/t/need-update-on-tiebreaker-fields-for-kibana-logs-event-sequence/273295 "2021-05-18T13:42:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cotjoey](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@cotjoey](https://discuss.elastic.co/u/cotjoey)\
**Post date:** [May 18, 2021, 1:42pm UTC](https://discuss.elastic.co/t/need-update-on-tiebreaker-fields-for-kibana-logs-event-sequence/273295/1 "2021-05-18T13:42:40Z")

</div>

Good morning,

Following up from another post I made a while ago, I want to know if in version 7.10.0 of Kibana, the `event.sequence` field is used automatically by the Kibana Logs application to sort the events that have the same @timestamp precision?

From what I understand, that field is part of the ECS ([Event Fields | Elastic Common Schema (ECS) Reference [1.9] | Elastic](https://www.elastic.co/guide/en/ecs/current/ecs-event.html#field-event-sequence)) and its description seems to do what I need ("...to make the exact ordering of events unambiguous, regardless of the timestamp precision." But I am not sure if the Kibana Logs application, when streaming or when filtering, is leveraging it to sort the events it is showing in the UI.

The documentation is not clear, and there seems to be more people not finding answers than there is that have (i.e. [Provide an official provision for tie-breaking events with the same @timestamp · Issue #1064 · elastic/ecs · GitHub](https://github.com/elastic/ecs/issues/1064)).

Thank you for any guidance you can provide on the tiebreaker field.

Joey

---

<div class="post-metadata">

**Author:** ![Kerry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kerry/32/40330_2.png) [@Kerry](https://discuss.elastic.co/u/Kerry)\
**Post date:** [May 24, 2021, 10:45am UTC](https://discuss.elastic.co/t/need-update-on-tiebreaker-fields-for-kibana-logs-event-sequence/273295/2 "2021-05-24T10:45:26Z")

</div>

Hi @cotjoey,

We don't use the `event.sequence` field for tiebreaking.

By default we use the `_doc` field. In older versions of Kibana this was configurable, but this is no longer the case.

 ![Screenshot 2021-05-24 at 11.41.12](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a2fa60a0e4c0bc33bb5d0b787bfed488d9f5441f.png)

---

<div class="post-metadata">

**Author:** ![cotjoey](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@cotjoey](https://discuss.elastic.co/u/cotjoey)\
**Post date:** [May 25, 2021, 4:23pm UTC](https://discuss.elastic.co/t/need-update-on-tiebreaker-fields-for-kibana-logs-event-sequence/273295/3 "2021-05-25T16:23:51Z")

</div>

Hello @Kerry ,

Since the `_doc` field is used for tiebreaking, how can I find the value of that field? When I use Discover in Kibana, there is no `_doc` fields either in the Table view or JSON view of a document.

Are those `_doc` field values incremented in a way that if multiple of the same timestamps end up in an index, it will sort them chronologically as per the value of `_doc` ?

Thanks,  
Joey

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2021, 4:24pm UTC](https://discuss.elastic.co/t/need-update-on-tiebreaker-fields-for-kibana-logs-event-sequence/273295/4 "2021-06-22T16:24:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.