# Way to sort walltime field with the format of hh:mm:ss

**URL:** <https://discuss.elastic.co/t/way-to-sort-walltime-field-with-the-format-of-hh-mm-ss/29086>\
**Category:** Logstash\
**Created:** [September 11, 2015, 4:48am UTC](https://discuss.elastic.co/t/way-to-sort-walltime-field-with-the-format-of-hh-mm-ss/29086 "2015-09-11T04:48:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![angelsmile](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@angelsmile](https://discuss.elastic.co/u/angelsmile)\
**Post date:** [September 11, 2015, 4:48am UTC](https://discuss.elastic.co/t/way-to-sort-walltime-field-with-the-format-of-hh-mm-ss/29086/1 "2015-09-11T04:48:44Z")

</div>

Hi,

There is a walltime field in our logs with the format of hh:mm:ss. What is the best format/way for this field in logstash so that we can have a panel in Kibana to sort these walltime data? Currently the field is stored as string, so the data are sorted in alphabet order instead of numeric order. For example for **"86:00:00", "48:30:00", "230:00:00"** , they should be sorted in the order of **"230:00:00" "86:00:00" "48:30:00"** in Kibana panel, but now they are sorted as **"86:00:00" "48:30:00" "230:00:00"**.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 11, 2015, 7:02am UTC](https://discuss.elastic.co/t/way-to-sort-walltime-field-with-the-format-of-hh-mm-ss/29086/2 "2015-09-11T07:02:14Z")

</div>

You should convert these to int's then, either in your grok or with a mutate =\> convert.

---

<div class="post-metadata">

**Author:** ![angelsmile](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@angelsmile](https://discuss.elastic.co/u/angelsmile)\
**Post date:** [September 11, 2015, 12:02pm UTC](https://discuss.elastic.co/t/way-to-sort-walltime-field-with-the-format-of-hh-mm-ss/29086/3 "2015-09-11T12:02:28Z")

</div>

Thanks Mark.

I cannot convert the field to int directly otherwise mm:ss will be trimmed. I tried grok, but got parse failure. Can you see what's wrong?

```
grok {
  match => ["walltime", "%{NUMBER:hour}:%{NUMBER:min}:%{NUMBER:sec"]
}

```

In case the field can be split to three fields, is it possible to sort multiple fields in a Kibana panel?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/way-to-sort-walltime-field-with-the-format-of-hh-mm-ss/29086/4 "2017-07-06T05:29:22Z")

</div>