Sorting on custom field

Elastic Stack Kibana
1

Hey there,

I know, that this topic has been discussed many many times, but unfortunately, no solution was proposed.
Correct me when I am wrong, this is all just my personal knowledge build by reading countless threads about this topic.

We have multiple processes and machines, which log to our instance. This means, that there are multiple events per millisecond, which are not shown in the correct order afterwards, due to the restriction of the timestamp only being millisecond precise.

I solved this by adding a sequence number to every event, meaning that the order of incoming events is preserved. This is not necessary the correct order of multiple devices but atleast from one process per device.
When I sort by this field manually, everything seems to work.

But I would like sort by this field automatically, without doing it in Discover manually.
At best, kibana would sort the events by timestamp first and sort the field with the same timestamp by the sequence number.

I cant find any setting to archieve this though. First I hoped for the sort:options setting, but this one does seem to do something different.

The context.tieBreakerOption is somewhat of a compromise, but it sort the events asc instead of descending. Which is exactly the opposit of what I need.

I there any way to do this?

2

@weltenwort Has talked about adding this kind of stuff to our design (multiple field sort in discovery). Unfortunately we don't have anything like that now, but he might have an idea on home to achieve it in another way.

3

Thats good in a weird way, I always kept thinking, that I was to dumb to find the solution :smiley:
Alright, then I hope for an answer from @weltenwort :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.