Kibana: Allow sorting on multiple fields

[mattwhite]

Currently it looks like kibana only allows you to sort a table on a single field. However, I believe elasticsearch allows multi-field sort.

[t2tviking]

+1

[ProTip]

+1 Would like to sort on date and sequence number.

[cyrildubus]

+1 This would be really useful to deal with very fast log (where timestamp is not enough)

[krenn08]

+1 This would prevent much sorting and resorting to find things in non-grouped items.

[kwlzn]

+1

[luzili]

+1

[ryan-stateless]

+1

[driv]

+1

[fbaligand]

+1

Concerning UI, this could be done like in datatables : by using "Shift+Click" on second, third, ... column.
https://datatables.net/examples/basic_init/multi_col_sort.html

[Rjdrenth]

+1

[luciamkh]

+1

[Inderjeet26]

+1

[usego]

timestamp + sequence sorting is really needed

[gairom]

+1

[mirath]

+1

[mirath]

How hard would this change be to implement?

[pghalliday]

+1

[tfgm-bud]

+1

[nheath]

+1

this would fix an issue we're seeing where events that are generated with the same timestamp can appear in the wrong sort order with respect to the original event source. Depending on the precision of your timestamps (e.g. a time format of HH:mm:ss), you may end up with a whole second worth of events in an undefined order.

[kafkapre]

+1

I cannot agree with Rashid. Preserving the order of logs as they came into Logstash, cannot substitute this feature. Because you can use more than one Logstash and logs can go through randomly chosen Logstash, so order of logs would not be preserved. So sorting on multiple fields is necessary.

[yosqueoy]

+1

[AlexeyRokhin]

required

[darrenliddell]

+1, would also like to sort on date and sequence number.

[Chadwiki]

+1

[detecti1]

+1

[aowen5000]

+1

[pmarrapese]

+1

[ghost]

+1

[malonej7]

:+1:

[txisme]

Is this featured in kibana yet?

[catta]

+1

I see 2 options for implementations:

1. In discovery screen somehow to choose a second column for sort. This is preferably.
2. In Edit search object to allow multiple sort criteria in Sort section.

[grypyrg]

👍

[clifflyon]

+1

[feli74]

+1

[danielbardsley]

+1

[radicarl]

+1

[astrosmash]

+1

[theage]

+100

[gitime]

+1

[carguel]

+1

[kzielin]

+1

[marv72]

+1

[pn141]

+1

[bahim]

+1

[yanghaikun]

+1, really need this feature

[iccicci]

+1

[theage]

+1

[ddtrd]

need it

[Trueffelwurm]

+1

[multani]

Guys, every time you are posting "+1" messages, you are sending annoying notifications to every single person who subscribed to this issue without adding anything but noise here (just look at the last dozens of messages!)

Github has a voting feature:

That would be great if you could just click on these buttons instead (which don't send all these notifications to everybody) to express your support and/or interest for this issue.

Thanks!

[Arungade]

Is there any resolution on this issue?

[StephenOTT]

+1

Would be great if we could at least use the custom query dsl to add the second sort. But this does not appear to work.

[oneiros-de]

I think by now it's clear that nobody from the Kibana team cares about this issue.

[cjcenizal]

Asked for in the forums: https://discuss.elastic.co/t/discover-sort-on-custom-fields/140367

[InternetPseudonym]

so ... major data aggregation & analytics tool and the primary UI doesnt support multi-sort although the backend does.

sigh

I think its time to search for a real elasticsearch-frontend, then - because Kibana obviously lacks core functionality.

@ devs : its probably time to abandon the frontend altogether, this project appears to be trainwreck. Awesome job on Elasticsearch & Logstash though!

[nreese]

Blocked by https://github.com/elastic/kibana/pull/16324

[hsluoyz]

Any update on this issue?

[randude]

+1 This is so basic that I'm shocked this isn't already part of the version.

[InternetPseudonym]

cute how the same troll keeps downvoting every single comment ... get a life.

Well, after six years its pretty safe to say : this isnt happening. Ever. Which is too bad.

[hemebond]

It's not "trolling". I'm down-voting pointless comments that cause me to receive notification emails.

If you want to see the feature, thumbs-up the original post. If you want to see the progress, just read the comments (while trying to ignore the spam of course).

If you _really_ want to see this feature, go pay someone to implement it.

[InternetPseudonym]

If you want to stop receiving notofications, simply disable them or change the type.

If you want to express your (massive) anger, do so elsewhere

If you really want to express your anger, do some trolling on 4chan or go and get a stress relief toy

[jenyphur]

So just a quick update on this...I was able to add a scripted field and concatenate two fields together to create a new field that I am able to use for sorting.

Although not completely optimal, it IS working and now can sort my discovery tab correctly.

[InternetPseudonym]

finally something productive again - thanks for sharing your workaround!

[nilsrobinsander]

@jenyphur
so you have an additional Field that needs to be generated on all queries besides @timestamp? could you make it visible in the "Time" column or do you need to add it every time to the discover table to trigger the sortation again and again after each search or every sortation on other fields?

In a professional Environment... this seems to be a not so nice solution

[jasonjsyang]

+1

[mattwhite]

Thanks for implementing this!!

I'll go dig up what I was working on in 2013 and give it a spin :)

[fbaligand]

Great news!
I can’t wait to test it!