project-reorder

This page explains how to reorder specified fields in the output.

Reorders specified fields in the output while keeping the original order of unspecified fields.

Syntax

| project-reorder FieldName1OrWildcard[*] [asc|desc|granny-asc|granny-desc], FieldName2OrWildcard[*], FieldName3OrWildcard  [direction], ...

Arguments

name	type	description
Field Name	string	The name of the field to be reordered in the output.
[direction]	string	Optional. Specifies the sort order for the reordered fields. Can be one of: asc, desc, granny-asc, or granny-desc. asc or desc orders fields by field name in ascending or descending manner, respectively. granny-asc or granny-desc orders by ascending or descending, respectively, while secondarily sorting by the next numeric value. For example, b50 comes before b9 when granny-asc is specified.

Returns

A table with the specified fields reordered as requested, followed by any unspecified fields in their original order. project-reorder doesn‘t rename or remove fields from the dataset, therefore, all fields that existed in the dataset, appear in the result table.

Examples

Reorder all fields in ascending order:

['sample-http-logs'] 
| project-reorder * asc

Run in Playground

Reorder specific fields to the beginning:

['sample-http-logs'] 
| project-reorder method, status, uri

Run in Playground

Reorder fields using wildcards and sort in descending order:

['github-push-event'] 
| project-reorder repo*, num_commits, push_id, ref, size, ['id'], size_large desc 

Run in Playground

Reorder specific fields and keep others in original order:

['otel-demo-traces']
| project-reorder trace_id, *, span_id // orders the trace_id then everything else, then span_id fields 

Run in Playground