This command is experimental


sort sorts defines how the results are sorted out.

Available sorting options are:


You can sort the dataset by using sort with the name of table column you want to sort.

index=example | sort _raw
the simpliest sort example

Sorting Order

The default sorting order is ascending. You can use desc to change the sorting order to descending.

index=example | sort _raw desc
descending example

You can also use + or - with table column names to define the sorting order.

Use + for ascending order.

index=example | sort + _raw desc

Use - for descending order.

index=example | sort - _raw desc

Sorting Options


auto sorting option automatically sorts the results.

index=example | sort auto(_raw)
example of auto sort


ip sorting option interprets selected values as IP addresses.

| spath
| sort ip(ipaddress)
example of ip sort


num sorting option interprets selected values as numbers.

index=example | sort num(_raw)
example of num sort


str sorting option interprets selected values as strings and orders them alphabetically.

| spath
| sort str(operation)
example of str sort


You can limit the amount of results by adding limit or a plain integer before the table column’s name.

If the count isn’t specified or the value is 0, sort will show 5 000 results by default.

index=example | sort 7 _raw
first count example
index=example | sort limit=7 _raw
second count example