Why
Swarm services run across multiple nodes — log entries arrive at the manager as received, not in timestamp order. STDOUT and STDERR also have different buffering behaviour. Sorting would require buffering everything, which is impossible with --follow.
Workaround
docker service logs --timestamps <service> 2>&1 | sort