sort
The sort command sorts the search results by the specified fields.
Syntax
The sort command supports two syntax notations. You must use one notation consistently within a single sort command.
Prefix notation
The sort command has the following syntax in prefix notation:
sort [<count>] [+|-] <field> [, [+|-] <field>]...
Suffix notation
The sort command has the following syntax in suffix notation:
sort [<count>] <field> [asc|desc|a|d] [, <field> [asc|desc|a|d]]...
Parameters
The sort command supports the following parameters.
| Parameter | Required/Optional | Description |
|---|---|---|
<field> | Required | The field used to sort. Use auto(field), str(field), ip(field), or num(field) to specify how to interpret field values. Multiple fields can be specified as a comma-separated list. |
<count> | Optional | The number of results to return. A value of 0 or less returns all results. Default is 0. |
[+|-] | Optional | Prefix notation only. The plus sign (+) specifies ascending order, and the minus sign (-) specifies descending order. Default is ascending order. |
[asc|desc|a|d] | Optional | Suffix notation only. Specifies the sort order: asc/a for ascending, desc/d for descending. Default is ascending order. |
Example 1: Sorting by one field
The following query sorts logs by severity number in ascending order, showing the least severe entries first:
source=otellogs
| sort severityNumber
| fields severityText, severityNumber, `resource.attributes.service.name`
| head 4
The query returns the following results:
| severityText | severityNumber | resource.attributes.service.name |
|---|---|---|
| DEBUG | 5 | cart |
| DEBUG | 5 | product-catalog |
| DEBUG | 5 | cart |
| INFO | 9 | frontend |
Example 2: Sorting by one field in descending order
The following query sorts logs by severity in descending order to surface the most critical issues first. You can use either prefix notation (- severityNumber) or suffix notation (severityNumber desc):
source=otellogs
| dedup severityText
| sort - severityNumber
| fields severityText, severityNumber
This query is equivalent to the following query:
source=otellogs
| dedup severityText
| sort severityNumber desc
| fields severityText, severityNumber
The query returns the following results:
| severityText | severityNumber |
|---|---|
| ERROR | 17 |
| WARN | 13 |
| INFO | 9 |
| DEBUG | 5 |
Example 3: Sorting by multiple fields
The following query sorts errors by severity descending and service name ascending, so the most critical issues appear first and services are alphabetical within each severity level. You can use either prefix notation (+/-) or suffix notation (asc/desc):
source=otellogs
| dedup severityText, `resource.attributes.service.name`
| sort + severityNumber, - `resource.attributes.service.name`
| fields severityText, severityNumber, `resource.attributes.service.name`
| head 5
The query returns the following results:
| severityText | severityNumber | resource.attributes.service.name |
|---|---|---|
| DEBUG | 5 | product-catalog |
| DEBUG | 5 | cart |
| INFO | 9 | frontend |
| INFO | 9 | checkout |
| INFO | 9 | cart |
The equivalent query using suffix notation is:
source=otellogs
| dedup severityText, `resource.attributes.service.name`
| sort severityNumber asc, `resource.attributes.service.name` desc
| fields severityText, severityNumber, `resource.attributes.service.name`
| head 5
The query returns the following results:
| severityText | severityNumber | resource.attributes.service.name |
|---|---|---|
| DEBUG | 5 | product-catalog |
| DEBUG | 5 | cart |
| INFO | 9 | frontend |
| INFO | 9 | checkout |
| INFO | 9 | cart |
Example 4: Sorting fields with null values
The default ascending order lists null values first. The following query sorts by the instrumentationScope.name field, showing that logs without instrumentation metadata appear before instrumented ones:
source=otellogs
| sort instrumentationScope.name
| fields instrumentationScope.name, severityText
| head 6
The query returns the following results:
| instrumentationScope.name | severityText |
|---|---|
| null | DEBUG |
| null | ERROR |
| null | INFO |
| null | ERROR |
| null | WARN |
| null | INFO |
Example 6: Specifying the number of sorted documents to return
The following query sorts all logs by severity and returns only the 3 least severe entries:
source=otellogs
| sort 3 severityNumber
| fields severityText, severityNumber
The query returns the following results:
| severityText | severityNumber |
|---|---|
| DEBUG | 5 |
| DEBUG | 5 |
| DEBUG | 5 |
Example 7: Sorting by specifying field type
The following query uses str() to sort severity numbers lexicographically instead of numerically. Notice that 5 and 9 appear after 21 because string sorting compares character by character:
source=otellogs
| dedup severityText
| sort str(severityNumber)
| fields severityText, severityNumber
The query returns the following results:
| severityText | severityNumber |
|---|---|
| WARN | 13 |
| ERROR | 17 |
| DEBUG | 5 |
| INFO | 9 |