FuseQL Reserved Fields

There are times that users may need to interact with the key fields during a FuseQL query. To address this, there are several reserved fields that can be used in FuseQL.

• __kf_msg - This is equivalent to the Message field from the Log Search Result. Regex matching is also optimized for __kf_msg with automatic substring extraction for improved query performance.

• __kf_level - This is equivalent to the Level field from the Log Search Result.

• __kf_source - This is equivalent to the Source field from the Log Search Result.

Query Example

__kf_msg =~ "ERROR.*connection.*timeout" __kf_level = "ERROR" and __kf_source = "nginx"

Alias Example

If you want to reorder the default log columns, you can use aliases. By using the alias with the reserved Field you can set the order that the Alias fields will appear and disable the default fields from being displayed.

* | __kf_msg as LogMessage | __kf_level as LogLevel | __kf_source as LogSource

Thanks for sharing your thoughts! Your feedback helps us improve.