Fields, layouts & sorting
A field explorer over the mapping, three ways to render the hits, and server-side sorting where the mapping allows it.
The field explorer
A searchable modal built from the index mapping lists every field, and picking some decides what the results actually show. Chosen fields appear as removable chips above the results, so the current shape of the table is visible without opening anything.
This is the difference between a log search that is useful on a 6" screen and one that is not: three well-chosen columns beat a wall of JSON.
Three layouts
The same hits render three ways, switchable at any time:
- list rows — one record per row, compact, best on a phone;
- aligned table — columns, best when you are comparing values;
- card grid — best on a tablet or a desktop window.
Sorting, honestly
In the table, tapping a column header sorts server-side — the search re-runs with a sort clause, so you are sorting the whole result set, not the page you happen to have loaded.
Elasticsearch cannot sort on a text field, so those headers are shown as not sortable
rather than failing when tapped. (This is one of the few places the Elasticsearch and
OpenObserve log screens genuinely differ: OpenObserve’s SQL
sorts on anything.)
There is no _id column. It is never what you are looking for, and it costs a column’s
worth of width.
Bookmarks
A bookmark here saves the whole search — the query, the index and the chosen field columns — so “the search I always run when the gateway misbehaves” is one tap from the connections list rather than something you rebuild from memory.
Back to Elasticsearch.