sort

Sorts events.

Synopsis

sort [--stable] <field> [<asc>|<desc>] [<nulls-first>|<nulls-last>]...

Description

Sorts events by a provided field.

--stable

Preserve the relative order of events that cannot be sorted because the provided fields resolve to the same value.

<field>

The name of the field to sort by.

Additionally, you may specify additional fields to sort by, in order of precedence. For each field, the sort order and null behavior may be specified separately. If multiple fields are specified, the sort order is always stable.

<asc>|<desc>

Specifies the sort order.

Defaults to asc.

<nulls-first>|<nulls-last>

Specifies how to order null values.

Defaults to nulls-last.

Examples

Sort by the timestamp field in ascending order.

sort timestamp

Sort by the timestamp field in descending order.

sort timestamp desc

Arrange by field foo and put null values first:

sort foo nulls-first

Arrange by field foo in descending order and put null values first:

sort foo desc nulls-first

Sort by the field src_ip and for matching values sort by dest_ip.

sort src_ip, dest_ip

Sort by the field foo in ascending order (default), by the field bar in descending order, and by the field baz in ascending order with nulls first.

sort foo, bar desc, baz asc nulls-first