fields
Description
Filters the displayed fields.
Syntax
fields <filter-options> <field-list>
Required Arguments
| Parameter | Syntax | Description |
|---|---|---|
<field-list> | <field> [, <field>] | List of fields to be filtered. |
Optional Arguments
| Parameter | Syntax | Default | Description |
|---|---|---|---|
<filter-options> | (+|-) | + | + indicates that the listed fields should remain, - indicates that the listed fields should be removed from the result. |
tip
The + indicator can be omitted.
Example Queries
Example #1
source radius_logs
| fields event.code, host.hostname
Example #2
source radius_logs
| fields - event.code
Example 5
This example uses a wildcard to exclude all fields starting with event.:
Example №5
source radius_logs
| fields - event.*