How can you sort data by a string value in Kibana Discovery (version 5.6.3
)? I would like to sort the rows asc
by field epoch.keyword
. Screenshot depicts the Kibana view below:
I've been experimenting with this function for a while, I've come to a conclusion that it isn't really achievable with the Add a filter +
functionality either, nor have I found an explanation for this on Elastic forum. What the Elasticsearch documentation says about the keyword
datatype:
They are typically used for filtering (Find me all blog posts where status is published), for sorting, and for aggregations. Keyword fields are only searchable by their exact value.
...therefore I take it, that it's achievable - I've managed to get a working query, that returns properly sorted entries (grepped out relevant output for brevity):
curl -X GET 'http://<someurl>:<someport>/<someindex>/_search' --user <somecredentials> -d '{"query":{ "match_all": {} }, "sort":[{"epoch.keyword":{"order":"asc"}}]}' | python -m json.tool | grep epoch
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 7569 100 7500 100 69 48622 447 --:--:-- --:--:-- --:--:-- 48701
"epoch": "1510238524.255196",
"epoch": "1510238524.2578862",
"epoch": "1510238524.2595582",
"epoch": "1510238526.231628",
"epoch": "1510238526.2461028",
"epoch": "1510238526.2461133",
"epoch": "1510238526.2502348",
"epoch": "1510238526.2502463",
"epoch": "1510238526.2802055",
"epoch": "1510238526.2821074",
Index mapping:
{
"<index-name>": {
"mappings": {
"doc": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"beat": {
"properties": {
"hostname": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"name": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"version": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
}
}
},
"container_id": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"container_name": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"epoch": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"fields": {
"properties": {
"logType": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
}
}
},
"host": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"message": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"namespace": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"offset": {
"type": "long"
},
"pod_name": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
},
"tags": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"type": "text"
}
}
}
}
}
}
How can I visualize the same query in Kibana Discovery?