# Sorting logevent datetime in asc order

**URL:** <https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532>\
**Category:** Elasticsearch\
**Created:** [April 28, 2021, 3:15pm UTC](https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532 "2021-04-28T15:15:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [April 28, 2021, 3:15pm UTC](https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532/1 "2021-04-28T15:15:43Z")

</div>

Hello Team,  
We have multiple logline for requestID & responseID. we need to identify which requestID & responseID come first and calculate difference between theses requestID time & responseID time.

```
Request Log:
OUT 2021-04-26 15:07:31.659151100 RequestID:p234
OUT 2021-04-26 15:07:32.789151100 RequestID:p234
OUT 2021-04-26 15:07:32.959151100 RequestID:p234
OUT 2021-04-26 15:08:33.059151100 RequestID:p234
OUT 2021-04-26 15:08:33.659151100 RequestID:p234

Response Log:
IN 2021-04-26 15:07:32.659151100 ResponseID:p234
IN 2021-04-26 15:07:33.659151100 ResponseID:p234
IN 2021-04-26 15:07:33.659151100 ResponseID:p234
IN 2021-04-26 15:07:34.659151100 ResponseID:p234
IN 2021-04-26 15:07:35.659151100 ResponseID:p234

```

We are combining requesttime & responsetime using below code:

```
if [RequestID]{

		  elasticsearch {
			hosts => ["localhost:9200"]
			index => "testindex"
			add_tag => ["test"]
			query => "RequestID:%{ResponseID} AND @timestamp:[now-2m/d TO now/d]"
			fields => { "RequestTime" => "RequestTime" }
		
		  }
		  mutate {
			add_tag => ["es_filter_test"]
		  }
		}

```

Currently it is combining time for all request & response. But i need it only for first requesttime & responsetime.

---

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [April 29, 2021, 3:57am UTC](https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532/2 "2021-04-29T03:57:27Z")

</div>

@Badger @warkolm @stephenb  
Can you please help me here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2021, 3:57am UTC](https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532/3 "2021-05-27T03:57:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.