ES|QL SORT command

The SORT processing command sorts a table on one or more expressions.

SORT expression1 [ASC/DESC][NULLS FIRST/NULLS LAST][, ..., expressionN [ASC/DESC][NULLS FIRST/NULLS LAST]]
		

expressionX

The expression to sort on. Can be a column name, a function (for example, length(field), DATE_EXTRACT("year", date)), or an arithmetic expression (for example, salary * 2). The expression is evaluated per row and the result is used for ordering.

The SORT processing command sorts a table on one or more expressions. You can sort by any expression, not only column names—for example, length(first_name) or DATE_EXTRACT("year", hire_date).

The default sort order is ascending. Use ASC or DESC to specify an explicit sort order.

Two rows with the same sort key are considered equal. You can provide additional sort expressions to act as tie breakers.

Sorting on multivalued columns uses the lowest value when sorting ascending and the highest value when sorting descending.

By default, null values are treated as being larger than any other value. With an ascending sort order, null values are sorted last, and with a descending sort order, null values are sorted first. You can change that by providing NULLS FIRST or NULLS LAST.

The following examples show how to control sort order, tie-breaking, null placement, and sorting by expressions.

FROM employees
| KEEP first_name, last_name, height
| SORT height
		

FROM employees
| KEEP first_name, last_name, height
| SORT height DESC
		

FROM employees
| KEEP first_name, last_name, height
| SORT height DESC, first_name ASC
		

FROM employees
| KEEP first_name, last_name, height
| SORT first_name ASC NULLS FIRST
		

You can sort by any expression, not just column names. The following example sorts rows by the length of the first_name field in descending order:

FROM employees
| KEEP first_name, last_name
| SORT length(first_name) DESC
| LIMIT 5