I am surprised that it orders them at all. The json object is key name specific, with ordering of list elements the only place where order could be important. I would think that sorting the keys is just a waste of time. The json format output is currently performance limited to around 15,000 events per second on the latest generation of CPU. I would be in favor of doing ANYTHING that could speed that up. Perhaps the ability to sort, and the ascending/descending order should be options to the json output template. Evan "Scheidler, Balázs" <balazs.scheidler@balabit.com> wrote: