Sort

Mutate Elastic Compatible

Synopsis

Sorts the elements of an array in ascending or descending order.

Schema

- sort:
    field: <ident>
    order: <enum>
    target_field: <ident>
    index_name: <string>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	N	-	Field to sort. Accepts an array or an object. Omit it to sort the event's own top-level keys — see below
order	N	asc	Sort order: asc or desc
target_field	N	field	Field to store the sorted array
index_name	N	-	Index name for sorting
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, continue silently if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

Details

Sorting keys rather than values

field is optional, and what the processor does depends on what it points at:

field	Operation
Omitted	Sorts the event's own top-level keys into order
An array	Sorts the elements
An object	Sorts that object's keys

The key-sorting modes reorder the map rather than producing a new value, so target_field does not apply to them. They exist to give an event a deterministic field order before it is serialized — useful when the output is diffed or hashed downstream.

Arrays of numbers will be sorted numerically, whereas string arrays will be sorted lexicographically. When dealing with mixed arrays containing both strings and numbers, the sorting is performed lexicographically.

A field holding neither a slice nor a map is an error. A map is not an error: its keys are sorted, which is a different operation from sorting an array and is described below.

warning

The processor will fail if the specified field does not exist or is not an array. Set ignore_failure to true to handle such cases.

Examples

String Arrays

Sorting a string array in ascending order...	{ "source": { "types": ["z", "b", "k"] } } - sort: field: source.types
orders strings lexicographically:	{ "source": { "types": ["b", "k", "z"] } }

Numeric Arrays

Sorting numeric arrays in ascending order...	{ "destination": { "types": [9, 3, 7] } } - sort: field: destination.types order: asc
orders numbers numerically:	{ "destination": { "types": [3, 7, 9] } }

Keep Original

Sorting the array into a new field...	{ "values": [5, 2, 8, 1] } - sort: field: values target_field: sorted_values
preserves the original array:	{ "values": [5, 2, 8, 1], "sorted_values": [1, 2, 5, 8] }