Reserved fields

When you collect logs or ship logs to other cloud services, Log Service adds log sources and timestamps to the logs in the form of key-value pairs. These fields are reserved in Log Service. This topic describes the reserved fields of Log Service.

Field	Type	Index and log analysis settings	Description
__time__	Integer (UNIX timestamp)	Index settings: The __time__ field is specified by using the from and to parameters in API operations. You do not need to create an index for this field. Log analysis settings: If you turn on the Enable Analytics switch for a column, the log analysis feature is enabled for the __time__ field by default.	The time when log data is written to a Logstore by using the API or an SDK. This field can be used to ship, query, and analyze logs.
__source__	String	Index settings: If you enable the indexing feature, Log Service creates an index for the __source__ field by default. The index is of the text type. No delimiter is specified for the indexes. To query logs based on the index on this field, you can enter source:127.0.0.1 or __source__:127.0.0.1. Log analysis settings: If you turn on the Enable Analytics switch for a column, the log analysis feature is enabled for the __source__ field by default.	The machine from which logs are collected. This field can be used to ship, query, analyze, and consume logs.
__topic__	String	Index settings: If you enable the indexing feature, Log Service creates an index for the __topic__ field by default. The index is of the text type. No delimiter is specified for the indexes. To query logs based on the index of this field, you can enter __topic__:XXX. Log analysis settings: If you turn on the Enable Analytics switch for a column, the log analysis feature is enabled for the __topic__ field by default.	The topic of a log. If you specify a topic for a log, Log Service adds a topic field to the log. The key of the field is __topic__ and the value of the field is the topic content. This field can be used to ship, query, analyze, and consume logs. For more information, see Log topic.
_extract_others_	String, which can be deserialized into a JSON map	This field does not exist in logs. You do not need to create an index for this field.	This field is the same as the __extract_others__ field. We recommend that you use the __extract_others__ field.
__tag__:__client_ip__	String	Index settings: If you enable the indexing feature, Log Service creates indexes for all fields by default. The indexes are of the text type. No delimiter is specified for the indexes. Exact match and fuzzy match are supported for log queries that are based on the index field. Log analysis settings: By default, the log analysis feature is disabled for the column indicated by this field. To enable the log analysis feature for this field, you must create an index for the __tag__:__client_ip__ field and turn on the Enable Analytics switch.	The public IP address of the machine from which logs are collected. This field is a system tag. If you enable the Log Public IP feature, Log Service adds this field to each raw log that is collected from the log source. This field can be used to query, analyze, and consume logs. When you execute SQL statements to analyze this field, you must enclose this field in double quotation marks (""). For more information, see Tag and Log Public IP.
__tag__:__receive_time__	String, which can be converted to an integer in the UNIX timestamp format	Index settings: If you enable the indexing feature, Log Service creates indexes for all tags by default. The indexes are of the text type. No delimiter is specified for the indexes. Exact match and fuzzy match are supported for log queries that are based on the index field. Log analysis settings: By default, the log analysis feature is disabled for the column indicated by this field. To enable the log analysis feature for this field, you must create an index for the __tag__:__receive_time__ field and turn on the Enable Analytics switch.	The time when Log Service receives a log. This field is a system tag. If you enable the Log Public IP feature, Log Service adds this field to each raw log that is collected from the log source. This field can be used to query, analyze, and consume logs. For more information, see Tag and Log Public IP.
__tag__:__path__	String	Index settings: If you enable the indexing feature, Log Service creates an index for the __tag__:__path__ field by default. The index is of the text type. No delimiter is specified for the index. To query logs based on the index of this field, you can enter __tag__:__path__:XXX. Log analysis settings: By default, the log analysis feature is disabled for the column indicated by this field. To enable the log analysis feature for this field, you must create an index for the __tag__:__path__ field and turn on the Enable Analytics switch.	The path to the log files collected by Logtail. Logtail automatically adds this field to logs. This field can be used to query, analyze, and consume logs. When you execute SQL statements to analyze this field, you must enclose this field in double quotation marks ("").
__tag__:__hostname__	String	Index settings: If you enable the indexing feature, Log Service creates an index for the __tag__:__hostname__ field by default. The index is of the text type. No delimiter is specified for the index. To query logs based on the index of this field, you can enter __tag__:__hostname__:XXX. Log analysis settings: By default, the log analysis feature is disabled for the column indicated by this field. To enable statistics for this field, create an index on the __tag__:__hostname__ field and enable the log analysis feature.	The hostname of the machine from which Logtail collects logs. Logtail automatically adds this field to logs. This field can be used to query, analyze, and consume logs. When you execute SQL statements to analyze this field, you must enclose this field in double quotation marks ("").
__raw_log__	String	You must create and configure an index of the text type for this field and enable the log analysis feature based on your business requirements.	The raw logs that fail to be parsed. If you disable the Drop Failed to Parse Logs feature, Logtail uploads raw logs that fail to be parsed. The key of this field is __raw_log__ and the value of this field is the log content. This field can be used to ship, query, analyze, and consume logs. For more information, see Drop Failed to Parse Logs.
__raw__	String	You must create and configure an index of the text type for this field and enable the log analysis feature based on your business requirements.	The raw logs that are parsed. If you enable the Upload Raw Log feature, Logtail uploads the raw logs in the __raw__ field together with the parsed logs. This field can be used in log audit and compliance check scenarios. This field can be used to ship, query, analyze, and consume logs. For more information, see Upload raw log.