"View Surrounding Documents" and "context:tieBreakerFields" does not show correct order for Filebeat collected data

[sophiaxu8]

Kibana version: 5.6.9/6.2.3

Elasticsearch version: 5.6.9/6.2.3

Server OS version:

Browser version:

Browser OS version:

Original install method (e.g. download page, yum, from source, etc.):

Description of the problem including expected versus actual behavior:

Steps to reproduce:

1. In Kibana, set the "context:tieBreakerFields" in Advanced setting to "offset,_doc"
2. use filebeat to send log files to elasticsearch through logstash
3. check "View surrounding document" from Kibana Discover

Timestamp of the document are in the right descending order, but offset which has same timestamp are in wrong asscending order.
Customer use Elastic 5.6.9 stack (kibana, logstash, elasticsearch), and I could reproduce this in 6.2.3.
Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):
/\ Newer Documents
Timestamp Offset
04/27/2018 12:55:00.000 1000
04/27/2018 12:55:00.000 1001
04/27/2018 12:55:00.000 1002
04/27/2018 12:54:00.000 997
04/27/2018 12:54:00.000 998
04/27/2018 12:54:00.000 999
04/27/2018 12:53:00.000 994
04/27/2018 12:53:00.000 995
04/27/2018 12:53:00.000 996
/ Older Documents

[sophiaxu8]

This seems like related to #12937

[passing]

the order of the tiebreaker field is in wrong order (opposite to the order for the @timestamp field), both for the "newer documents" and "older documents":

"sort":[{"@timestamp":{"order":"asc","unmapped_type":"boolean"}},{"offset":{"order":"desc","unmapped_type":"boolean"}}]

"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}},{"offset":{"order":"asc","unmapped_type":"boolean"}}]

complete request params:

{"index":"logstash-access","ignore_unavailable":true,"timeout":30000,"preference":1532000817706}
{"version":true,"size":5,"search_after":[1532000712091,789037],"sort":[{"@timestamp":{"order":"asc","unmapped_type":"boolean"}},{"offset":{"order":"desc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}}],"filter":[],"should":[],"must_not":[]}}}
{"index":"logstash-access","ignore_unavailable":true,"timeout":30000,"preference":1532000817706}
{"version":true,"size":5,"search_after":[1532000712091,789037],"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}},{"offset":{"order":"asc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}}],"filter":[],"should":[],"must_not":[]}}}

[justinwalz]

Hi, is any update on this ticket? I'd appreciate any sort of timeline on when this might be working again. Thank you.

[thethomp]

Can confirm this is still broken in Kibana 7.1.1 (in the Discover App view).

[kertal]

I've checked and it works in our latest upcoming release 8.14 and also in 7.13. Therefore I'm closing this issue