Type to search.

Sort processor

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack 9.4+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.4

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The Sort processor sorts the elements of an array field in ascending or descending order.

To sort an array field:

  1. Select Create → Create processor.
  2. Select Sort from the Processor menu.
  3. Set the Source Field to the array field you want to sort.
  4. Set Order to Ascending or Descending. Defaults to Ascending.
  5. (Optional) Set Target field to write the sorted array to a different field. Leave empty to update the Source Field.

This functionality uses the Elasticsearch Sort processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

In YAML mode, configure the sort processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter Type Required Description
from string Yes Array field to sort.
to string No Target field for the sorted array. Defaults to the source field.
order string No Sort order: asc or desc. Defaults to asc.
ignore_missing boolean No When true, skip this processor if the source field is missing.
YAML 
- action: sort
  from: attributes.tags
  order: desc

Given a document with attributes.tags set to ["charlie", "alpha", "bravo"], the processor updates the field to ["charlie", "bravo", "alpha"].