We have two search heads, one for general use and one for ES.
Any table/stats searches on the ES search head appear with the columns sorted alphanumerically - resulting in _time as the last field if you're doing a timechart. This then messes up line charts etc. that expect _time to be the first column (i.e. the x axis).
The sorting happens as the search head finalises search results - if you run a long search you'll see columns {_time, b, c, a} then as the search finalizes you'll see the browser rearrange them into {a, b, c, _time}. Viewing that as a line chart is then a disaster.
Has anyone seen this before?
↧