Available: array:sort() v1.173.0

The array:sort() function is available from version 1.173.

This function sorts the elements of an array of values using the given sorting data type and order.

By default, this function replaces the input array with the sorted result, but it is possible to specify a different output array using a parameter.

The elements can be sorted as strings (lexicographically) or as numbers, either ascending and descending. Default is ascending.

Sorting as strings is case insensitive and elements that are identical except for case are kept in unspecified order. When sorting as numbers, elements that are not numbers, are sorted separately as strings, and appear after the numbers in the output array (regardless of sort order).

ParameterTypeRequiredDefault ValueDescription
array[a]array namerequired   The array to sort elements in. Must follow valid Array Syntax. For example, for an array of fields incidents[0], incidents[1], and so on, this would be incidents[].
asArraystringoptional[b] input array Where to output the sorted array. The output array is not explicitly terminated, that is, if an array already exists, parts of it or the whole array may be overwritten.
orderstringoptional[b] asc The order in which to sort. The short variants asc and desc can also be used.
   Valid Values
   ascendingSort ascending
   descendingSort descending
typestringoptional[b] string The type of data to sort by.
   Valid Values
   numberTreat the field as numerical and sort in numerical order
   stringTreat the field as string values and sort alphabetical

[a] The parameter name array can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

Like other array functions, array:sort() overwrites the entries of the target array, if the entry already exists. If the target array has more entries than the source array, the array:sort() does not remove additional entries in the target array.

A specific syntax applies for this query function, see Array Syntax for details.

In the following are examples of usage:

By default, the elements of the array are sorted as strings in ascending order. Sorting as strings is case insensitive.

Raw Events
{ \"array\": [\"date\", \"apple\", \"Coconut\", \"Cherry\", \"coconut\", \"banana\"]}"]

Specify the name of the array field from which to sort:

logscale
parseJson()
| array:sort("array[]")

Sample output from the incoming example data:

array[0]array[1]array[2]array[3]array[4]array[5]
applebananaCherryCoconutcoconutdate

When sorting as strings, numbers are treated as strings and sorted digit by digit.

Raw Events
{\"array\": [5, 2, 11, 2, 10, 41]}"])

Specify the name of the array field from which to sort:

logscale
parseJson()
| array:sort("array[]")

Sample output from the incoming example data:

array[0]array[1]array[2]array[3]array[4]array[5]
101122415

To sort numbers by value, the type has to be specified as number.

Raw Events
{\"array\": [5, 2, 11, 2, 10, 41]}"])

Specify the name of the array field from which to sort:

logscale
parseJson()
| array:sort("array[]", type=number)

Sample output from the incoming example data:

array[0]array[1]array[2]array[3]array[4]array[5]
225101141

The sorted elements can be written to a different array using the asArray parameter.

Raw Events
{ \"array\": [\"date\", \"apple\", \"Coconut\", \"Cherry\", \"coconut\", \"banana\"]}

Specify the name of the array field from which to sort:

logscale
parseJson()
| array:sort("array[]", asArray="sorted[]")

Sample output from the incoming example data:

array[0]array[1]array[2]array[3]array[4]array[5]sorted[0]sorted[1]sorted[2]sorted[3]sorted[4]sorted[5]
dateappleCoconutCherrycoconutbananaapplebananaCherryCoconutcoconutdate

The order of the result can be specified using the order parameter. Default is ascending.

Raw Events
{\"array\": [5, 2, 11, 2, 10, 41]}"])

Specify the name of the array field from which to sort:

logscale
parseJson()
| array:sort("array[]", type=number, order=descending)

Sample output from the incoming example data:

array[0]array[1]array[2]array[3]array[4]array[5]
411110522

When sorting as numbers, the elements that are not numbers, are sorted separately and appear after the sorted numbers.

Raw Events
{\"array\": [\"banana\", 5, 2, \"apple\", 10, 41]}"])

Specify the name of the array field from which to sort:

logscale
parseJson()
| array:sort("array[]", type=number)

Sample output from the incoming example data:

array[0]array[1]array[2]array[3]array[4]array[5]
251041applebanana

This is also the case for descending number sorting.

Raw Events
{\"array\": [\"banana\", 5, 2, \"apple\", 10, 41]}"])

Specify the name of the array field from which to sort:

logscale
parseJson()
| array:sort("array[]", type=number, order=descending)

Sample output from the incoming example data:

array[0]array[1]array[2]array[3]array[4]array[5]
411052bananaapple

Overwriting the entries of the target array if it already exists, but if the target array has more entries than the source array, the additional entries of the target array are not removed.

Raw Events
{\"a\": [3, 1, 2], \"b\": [5, 5, 5, 5]}"])

Specify the name of the array field from which to sort:

logscale
parseJson()
| array:sort("a[]", asArray="b[]")

Sample output from the incoming example data:

a[0]a[1]a[2]b[0]b[1]b[2]b[3]
3121235