Simple Log Service reserved fields - Simple Log Service - Alibaba Cloud Documentation Center

When collecting or shipping logs, Simple Log Service adds metadata such as source and timestamp as key-value pairs. These are reserved fields.

Important

When writing log data through an API or Logtail, do not use reserved field names as custom keys. Duplicate names cause field conflicts and inaccurate queries.
If your Logstore uses the pay-by-ingested-data billing mode, Simple Log Service does not charge for the reserved fields it adds to your logs.
If your Logstore uses the pay-by-feature billing mode, charges apply to the added reserved fields. Enabling an index for these fields also incurs minor fees for index traffic and storage.

Reserved field	Type	Index and analysis	Description
`__time__`	Integer. A standard Unix timestamp.	`__time__`Index configuration: Specifies time ranges in API calls. No index required. `__time__`Log analysis configuration: Auto-enabled when any other field has log analysis enabled.	The log timestamp, specified at write time. Used for log shipping, queries, and analysis.
`__source__`	String.	`__source__source:127.0.0.1__source__:127.0.0.1`Index configuration: Auto-created when indexing is enabled. Data type: text, no delimiter. To query logs, use or . `__source__`Log analysis configuration: Auto-enabled when any other field has log analysis enabled.	Log source (e.g., IP address or machine identifier). Used for log shipping, queries, analysis, and custom consumption.
`__topic__`	String.	`__topic____topic__:XXX`Index configuration: Auto-created when indexing is enabled. Data type: text, no delimiter. To query logs, use . `__topic__`Log analysis configuration: Auto-enabled when any other field has log analysis enabled.	`__topic__`The log topic. Added automatically when you set a topic. The key is and the value is the topic content. Used for log shipping, queries, analysis, and custom consumption. topic.
`_extract_others_`	A string that can be deserialized into a JSON map.	This field does not exist in the log content. You do not need to create an index for it.	`__extract_others____extract_others__`Alias for . Use instead.
`__tag__:__client_ip__`	String.	Index configuration: Auto-created (text, no delimiter) for all tag fields when indexing is enabled. Supports exact and fuzzy queries. `__tag__:__client_ip__`Log analysis configuration: Disabled by default. To enable, create an index for and turn on log analysis.	Public IP address of the log source. Appended by the server when public IP recording is enabled. Used for log queries, analysis, and custom consumption. Enclose in double quotation marks ("") in SQL analysis. tag and Record public IP addresses.
`__tag__:__receive_time__`	String. Convertible to an integer Unix timestamp.	Index configuration: Auto-created (text, no delimiter) for all tag fields when indexing is enabled. Supports exact and fuzzy queries. `__tag__:__receive_time__`Log analysis configuration: Disabled by default. To enable, create an index for and turn on log analysis.	Server receive time. Appended when public IP recording is enabled. Used for log queries, analysis, and custom consumption. tag and Record public IP addresses.
`__tag__:__path__`	String.	`__tag__:__path____tag__:__path__:XXX`Index configuration: Auto-created when indexing is enabled. Data type: text, no delimiter. To query logs, use . `__tag__:__path__`Log analysis configuration: Disabled by default. To enable, create an index for and turn on log analysis.	Log file path, added by Logtail during collection. Used for log queries, analysis, and custom consumption. Enclose in double quotation marks ("") in SQL analysis.
`__tag__:__hostname__`	String.	`__tag__:__hostname____tag__:__hostname__:XXX`Index configuration: Auto-created when indexing is enabled. Data type: text, no delimiter. To query logs, use . `__tag__:__hostname__`Log analysis configuration: Disabled by default. To enable, create an index for and turn on log analysis.	Hostname of the collection machine, added by Logtail. Used for log queries, analysis, and custom consumption. Enclose in double quotation marks ("") in SQL analysis.
`__raw_log__`	String.	Manually create an index (text type) for this field. Enable log analysis as needed.	`__raw_log__`Raw log content when parsing fails. Populated when the Drop Failed to Parse Logs feature is disabled. Used for log shipping, queries, analysis, and custom consumption.
`__raw__`	String.	Manually create an index (text type) for this field. Enable log analysis as needed.	`__raw__`Original raw log after successful parsing. When the Upload Raw Log feature is enabled, Logtail stores raw content alongside parsed data. Useful for auditing and compliance. Used for log shipping, queries, analysis, and custom consumption.