You’ll have to remove the r._field == "orderId" predicate. Each _field key-value pair in InfluxDB is stored in an individual “record” or “row.” A record can have multiple tags, but it only ever has one _field and one _value. You can have multiple records with the same timestamp, each for a different field.
I think in this case, orderId would be better as a tag rather than a field. Especially if you have multiple fields associated with each orderId. The downside here is that this will increase series cardinality, but that may not be a big issue.
@scott Thanks, it will help me to re-think about my current message structure. I am not very comfortable in making orderId as tag as it’s unique for each order and we are having hardly 3-5 events for each order.