All Products
Search

This Product

    Simple Log Service:Reserved fields

    Document Center

    Simple Log Service:Reserved fields

    Last Updated:Jun 04, 2026

    When collecting or shipping logs, Simple Log Service adds metadata such as source and timestamp as key-value pairs. These are reserved fields.

    Important
    • When writing log data through an API or Logtail, do not use reserved field names as custom keys. Duplicate names cause field conflicts and inaccurate queries.
    • __tag__Legacy shipping tasks do not support fields with this prefix.
    • If your Logstore uses the pay-by-ingested-data billing mode, Simple Log Service does not charge for the reserved fields it adds to your logs.
    • If your Logstore uses the pay-by-feature billing mode, charges apply to the added reserved fields. Enabling an index for these fields also incurs minor fees for index traffic and storage.
    Reserved field Type Index and analysis Description
    __time__ Integer. A standard Unix timestamp.
    • __time__Index configuration: Specifies time ranges in API calls. No index required.
    • __time__Log analysis configuration: Auto-enabled when any other field has log analysis enabled.
    		 The log timestamp, specified at write time. Used for log shipping, queries, and analysis.
    __source__ String.
    • __source__source:127.0.0.1__source__:127.0.0.1Index configuration: Auto-created when indexing is enabled. Data type: text, no delimiter. To query logs, use or .
    • __source__Log analysis configuration: Auto-enabled when any other field has log analysis enabled.
    		 Log source (e.g., IP address or machine identifier). Used for log shipping, queries, analysis, and custom consumption.
    __topic__ String.
    • __topic____topic__:XXXIndex configuration: Auto-created when indexing is enabled. Data type: text, no delimiter. To query logs, use .
    • __topic__Log analysis configuration: Auto-enabled when any other field has log analysis enabled.
    		 __topic__The log topic. Added automatically when you set a topic. The key is and the value is the topic content. Used for log shipping, queries, analysis, and custom consumption. topic.
    _extract_others_ A string that can be deserialized into a JSON map. This field does not exist in the log content. You do not need to create an index for it. __extract_others____extract_others__Alias for . Use instead.
    __tag__:__client_ip__ String.
    • Index configuration: Auto-created (text, no delimiter) for all tag fields when indexing is enabled. Supports exact and fuzzy queries.
    • __tag__:__client_ip__Log analysis configuration: Disabled by default. To enable, create an index for and turn on log analysis.
    		 Public IP address of the log source. Appended by the server when public IP recording is enabled. Used for log queries, analysis, and custom consumption. Enclose in double quotation marks ("") in SQL analysis. tag and Record public IP addresses.
    __tag__:__receive_time__ String. Convertible to an integer Unix timestamp.
    • Index configuration: Auto-created (text, no delimiter) for all tag fields when indexing is enabled. Supports exact and fuzzy queries.
    • __tag__:__receive_time__Log analysis configuration: Disabled by default. To enable, create an index for and turn on log analysis.
    		 Server receive time. Appended when public IP recording is enabled. Used for log queries, analysis, and custom consumption. tag and Record public IP addresses.
    __tag__:__path__ String.
    • __tag__:__path____tag__:__path__:XXXIndex configuration: Auto-created when indexing is enabled. Data type: text, no delimiter. To query logs, use .
    • __tag__:__path__Log analysis configuration: Disabled by default. To enable, create an index for and turn on log analysis.
    		 Log file path, added by Logtail during collection. Used for log queries, analysis, and custom consumption. Enclose in double quotation marks ("") in SQL analysis.
    __tag__:__hostname__ String.
    • __tag__:__hostname____tag__:__hostname__:XXXIndex configuration: Auto-created when indexing is enabled. Data type: text, no delimiter. To query logs, use .
    • __tag__:__hostname__Log analysis configuration: Disabled by default. To enable, create an index for and turn on log analysis.
    		 Hostname of the collection machine, added by Logtail. Used for log queries, analysis, and custom consumption. Enclose in double quotation marks ("") in SQL analysis.
    __raw_log__ String. Manually create an index (text type) for this field. Enable log analysis as needed. __raw_log__Raw log content when parsing fails. Populated when the Drop Failed to Parse Logs feature is disabled. Used for log shipping, queries, analysis, and custom consumption.
    __raw__ String. Manually create an index (text type) for this field. Enable log analysis as needed. __raw__Original raw log after successful parsing. When the Upload Raw Log feature is enabled, Logtail stores raw content alongside parsed data. Useful for auditing and compliance. Used for log shipping, queries, analysis, and custom consumption.