Saved search

[liorg2]

Hi,
I have created a saved search, and no matter how I try to sort the table, it always sorts by @timestamp, AND the column I asked to sort by.
Is that by design, or something that I have missed?

thanks

[Nathan_Reese]

What version of kibana are you using? Using inspector, what is the sort getting applied to your ES query? Have you tried clicking Time arrows twice to cycle through desc, asc, off?

[liorg2]

hi @Nathan_Reese

I'm using 7.6.1
I tried to click few times (asc/desc/stop sorting)

inspect without sort on Time:

 "sort": [
{
  "@timestamp": {
    "order": "desc",
    "unmapped_type": "boolean"
  }
},
{
  "cpu": {
    "order": "asc",
    "unmapped_type": "boolean"
  }
}
  ],

when trying to sort by datetime field:

  "sort": [
{
  "@timestamp": {
    "order": "desc",
    "unmapped_type": "boolean"
  }
},
{
  "datetime": {
    "order": "asc",
    "unmapped_type": "boolean"
  }
}

],

no matter how I change the sort,

I always have first the:

  {
  "@timestamp": {
    "order": "desc",
    "unmapped_type": "boolean"
  }
},

[Nathan_Reese]

When first creating a search, the results are sorted by timestamp.

"sort": [
    {
      "timestamp": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ]

Then when you turn on sort for another field, the sort request block looks like

"sort": [
    {
      "timestamp": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    },
    {
      "bytes": {
        "order": "asc",
        "unmapped_type": "boolean"
      }
    }
  ]

Try hovering over the sort arrows for timestamp. Do they show something like

[liorg2]

yep: