Elasticsearch query - sort by @timestamp and another field?

Question

Can I search elasticsearch (version 2.3) and in the search query sort by more than 1 field? Right now i'm sorting by @timestamp and I would like to sort by hostname as well.

Thanks,

svarog · Accepted Answer · 2024-03-24 13:56:39Z

28

As the doc says, you can add one or more sort on specific fields like this:

"sort" : [
    { 
        "@timestamp" : "desc" 
    },  
    { 
        "hostname " : "desc" 
    }
]

edited Mar 24, 2024 at 13:56

svarog

9,8855 gold badges66 silver badges79 bronze badges

answered Oct 1, 2017 at 16:29

Taras Kohut

2,5753 gold badges21 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Kalle Richter · Accepted Answer · 2021-04-24 17:07:15Z

9

{
    "query": {
        "range": {
            "@timestamp": {
                "gte": "@timestamp",
                "lte": "@timestamp"
            }
        }
    },
    "from": 0,
    "size": 1000,
    "_source": [
        "@timestamp",
    ],
    "sort": [{
            "@timestamp": {
                "order": "desc"
            }
        },
        {
            "age": "desc"
        }
    ]
}

edited Apr 24, 2021 at 17:07

Kalle Richter

8,85429 gold badges96 silver badges209 bronze badges

answered Jun 17, 2020 at 14:32

Anush Akshantal

911 silver badge1 bronze badge

Collectives™ on Stack Overflow

Elasticsearch query - sort by @timestamp and another field?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related