Loading

ES|QL MV_SORT function

Sorts the values in a multi-value field.

Embedded
field
Expression that can be null, a single value, or multiple values. If null, the function returns null.
order

Sort order. The valid options are ASC and DESC, the default is ASC.

Sorts a multivalued field in lexicographical order.

field order result
boolean keyword boolean
boolean boolean
date keyword date
date date
date_nanos keyword date_nanos
date_nanos date_nanos
double keyword double
double double
integer keyword integer
integer integer
ip keyword ip
ip ip
keyword keyword keyword
keyword keyword
long keyword long
long long
text keyword keyword
text keyword
unsigned_long keyword unsigned_long
unsigned_long unsigned_long
version keyword version
version version 
ROW a = [4, 2, -3, 2]
| EVAL sa = mv_sort(a), sd = mv_sort(a, "DESC")
a:integer sa:integer sd:integer
[4, 2, -3, 2] [-3, 2, 2, 4] [4, 2, 2, -3]