In Log Service, some fields are reserved. When you add Logtail configurations or call API operations to write log data, do not set the names of fields to be the same as those of reserved fields.
Important notes
__source__
.
- When you add Logtail configurations or call API operations to write log data, do not set the names of fields (that is, keys) to be the same as those of reserved fields. Otherwise, duplicate field names may cause problems such as inaccurate queries.
- Log Service does not deliver any fields prefixed with
__tag__
. - Log Service charges you in Billing method mode for the new fields that you specify to be recorded in logs. If you enable the indexing feature for the fields, you are also charged a small fee for the indexing and storage traffic.
Reserved fields
The following table describes the reserved fields in Log Service.
Field | Type | Index and statistics settings | Description |
---|---|---|---|
__time__ |
Integer, in UNIX timestamp format.
For example, |
|
The log time that you specify when you use the API or SDK to write log data. This field can be used for log delivery, query, and analysis. |
__source__ |
String. |
|
The device from which logs are collected. This field can be used for log delivery, query, analysis, and custom consumption. |
__topic__ |
String. |
|
The topic of logs. If you have set a log topic, Log Service automatically adds the topic field to your logs with the key set to
__topic__ and the value set to the topic content that you specified. This field can be used
for log delivery, query, analysis, and custom consumption.
|
_extract_others_ |
String, which can be deserialized into a JSON map. | You do not need to create an index on this field because this field does not exist in any logs. | This field is the same as the __extract_others__ field. We recommend that you use the __extract_others__ field.
|
__tag__:__client_ip__ |
String. |
|
The public IP address of the device from which logs are collected. This field is a
system tag. After the Log Public IP feature is enabled, the server adds this field to each raw log received. This field
can be used for log query, analysis, and custom consumption.
When conducting SQL analysis on this field, you must enclose this field in double quotation marks (" "). |
__tag__:__receive_time__ |
String, which can be converted to an integer in UNIX timestamp format. |
|
The time when the server receives a log. This field is a system tag. After the Log Public IP feature is enabled, the server adds this field to each raw log received. This field can be used for log query, analysis, and custom consumption. |
__tag__:__path__ |
String. |
|
The path to log files collected by Logtail. Logtail automatically adds this field
to logs. This field can be used for log query, analysis, and custom consumption.
When conducting SQL analysis on this field, you must enclose this field in double quotation marks (" "). |
__tag__:__hostname__ |
String. |
|
The hostname of the device from which Logtail collects data. Logtail automatically
adds this field to logs. This field can be used for log query, analysis, and custom
consumption.
When conducting SQL analysis on this field, you must enclose this field in double quotation marks (" "). |
__raw_log__ |
String. | You need to create and configure an index of the text type on this field and enable the statistics feature as needed. | The raw logs that fail to be parsed. After the Drop Failed to Parse Logs feature is disabled, Logtail uploads raw logs if log parsing fails. In this field,
the key is __raw_log__ and the value is the log content. This field can be used for log delivery, query,
analysis, and custom consumption.
|
__raw__ |
String. | You need to create and configure an index of the text type on this field and enable the statistics feature as needed. | The raw logs that are parsed. After the Upload Raw Log feature is enabled, Logtail uploads the raw logs in the __raw__ field together with the parsed logs. This field is used in log audit and compliance
check scenarios. This field can be used for log delivery, query, analysis, and custom
consumption.
|