Fails to sort by timestamp

[rymdbullen]

Hello,
I dont know if it is a bug or a feature. When I add timestamp as a column in the All event list view, I'm not able to sort the events by date/time, the following example show my problem:

2014-01-08 13:07:59,961
2014-01-08 12:24:59,961
2014-01-08 12:24:59,961
2014-01-08 12:54:59,962

Evidently, these events are not sorted even if I have activated the sorting on timestamp.

I'm using Milestone 3 and Milestone 2, both versions show the same behaviour.

Please, could someone shed some light on this "issue"?

Best Regards

[electrical]

have you tried Milestone 4 as well or latest master?

[rymdbullen]

I have just verified on the latest master. I'm sorry to say that it does not work as supposed to. What can I do to provide you with more information ?

It seems that a subset of the events are sorted, but as more events are added to the list, Kibana does not sort the new events.

[rashidkpc]

Can you post your elasticsearch mapping? I note that you timestamps are not iso8601, are you sure they're being mapped as dates in Elasticsearch and not strings?

[rymdbullen]

Furthermore, not really related to this issue, but anyway:

When I click on the timestamp column header the list of events is updated, but the graph (events over time) is not updated.

[rymdbullen]

Sorry, but how do I get the mappings in elasticsearch, what request is necessary to perform?

[rashidkpc]

curl -XGET localhost:9200/_mapping?pretty

[rymdbullen]

[vagrant@localhost elasticsearch]$ curl -XGET localhost:9200/_mapping?pretty
{
"logstash-2014.01.08" : {
"logs" : {
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "dateOptionalTime"
},
"@Version" : {
"type" : "string"
},
"class" : {
"type" : "string"
},
"host" : {
"type" : "string"
},
"logmessage" : {
"type" : "string"
},
"message" : {
"type" : "string"
},
"path" : {
"type" : "string"
},
"priority" : {
"type" : "string"
},
"session" : {
"type" : "string"
},
"thread" : {
"type" : "string"
},
"timestamp" : {
"type" : "string"
},
"type" : {
"type" : "string"
},
"user" : {
"type" : "string"
}
}
}
}
}

[rashidkpc]

You timestamp field is mapped as a string. You should be using logstash's @timestamp field. Closing this as it is not a kibana bug.

[rymdbullen]

Hmm, yeah sorry, I think made an awful error there. The column that I used as timestamp is not the good one. It seems to work with the @timestamp key.

=> Thank you very much for the excellent support and killer application Kibana!

[Blatwurst]

I'm having a similar problem. What I don't understand is why, if the field is just a string field, but sorting that field naively as a string would produce the right result, why does it not?

I would think that the example noted in the initial question should sort fine as a string field, per how it's formatted.

Is sorting text fields not straightforward in kibana/elasticsearch?