When you collect logs or ship logs to other cloud services, Log Service adds log sources and timestamps to the logs in the form of key-value pairs. These fields are reserved in Log Service. This topic describes the reserved fields of Log Service.
Notice
- When you add Logtail configurations or call API operations to write log data, you cannot set the names of fields (keys) to be the same as those of reserved fields. If the names are the same, inaccurate queries or other issues may occur due to duplicate field names.
- Log Service does not ship fields that are prefixed by
__tag__
. - You are charged for the fields that you add for logs based on the pay-as-you-go billing method. If you enable the indexing feature for the fields, you are also charged a small fee for index traffic and storage. For more information, see Pay-as-you-go.
Field | Type | Index and log analysis settings | Description |
---|---|---|---|
__time__ |
Integer (UNIX timestamp) |
|
The time when log data is written to a Logstore. This field can be used to ship, query, and analyze logs. |
__source__ |
String |
|
The machine from which logs are collected. This field can be used to ship, query, analyze, and consume logs. |
__topic__ |
String |
|
The topic of a log. If you specify a topic for a log, Log Service adds a topic field
to the log. The key of the field is __topic__ and the value of the field is the topic content. This field can be used to ship,
query, analyze, and consume logs. For more information, see Log topic.
|
_extract_others_ |
String, which can be deserialized into a JSON map | This field does not exist in logs. You do not need to create an index for this field. | This field is the same as the __extract_others__ field. We recommend that you use the __extract_others__ field.
|
__tag__:__client_ip__ |
String |
|
The public IP address of the machine from which logs are collected. This field is a system tag. If you enable the Log Public IP feature, Log Service adds this field to each raw log that is collected from the log source. This field can be used to query, analyze, and consume logs. When you execute SQL statements to analyze this field, you must enclose this field in double quotation marks (""). For more information, see Tags and Log Public IP. |
__tag__:__receive_time__ |
String, which can be converted to an integer in the UNIX timestamp format |
|
The time when Log Service receives a log. This field is a system tag. If you enable the Log Public IP feature, Log Service adds this field to each raw log that is collected from the log source. This field can be used to query, analyze, and consume logs. For more information, see Tags and Log Public IP. |
__tag__:__path__ |
String |
|
The path to the log files collected by Logtail. Logtail automatically adds this field to logs. This field can be used to query, analyze, and consume logs. When you execute SQL statements to analyze this field, you must enclose this field in double quotation marks (""). |
__tag__:__hostname__ |
String |
|
The hostname of the machine from which Logtail collects logs. Logtail automatically adds this field to logs. This field can be used to query, analyze, and consume logs. When you execute SQL statements to analyze this field, you must enclose this field in double quotation marks (""). |
__raw_log__ |
String | You must create and configure an index of the text type for this field and enable the log analysis feature based on your business requirements. | The raw logs that fail to be parsed. If you disable the Drop Failed to Parse Logs
feature, Logtail uploads raw logs that fail to be parsed. The key of this field is
__raw_log__ and the value of this field is the log content. This field can be used to ship, query,
analyze, and consume logs. For more information, see Drop Failed to Parse Logs.
|
__raw__ |
String | You must create and configure an index of the text type for this field and enable the log analysis feature based on your business requirements. | The raw logs that are parsed. If you enable the Upload Raw Log feature, Logtail uploads
the raw logs in the __raw__ field together with the parsed logs. This field can be used in log audit and compliance
check scenarios. This field can be used to ship, query, analyze, and consume logs.
For more information, see Upload raw log.
|