fields

Description

Filters displayed fields. Allows adding fields to the query or excluding them from it. Supports wildcard.

Syntax

fields <filter-options> <field-list>

Required Arguments

Parameter	Syntax	Description
<field-list>	<field>* [, <field>*]	List of fields to filter. Supports wildcard.

Optional Arguments

Parameter	Syntax	Default	Description
<filter-options>	(+|-)	+	+ indicates that the listed fields should remain, - indicates that the listed fields should be removed from the result.

tip

The + indicator can be omitted.

---

Example Queries

Example 1

The source network_indexes contains network events. In this example, the fields command limits the output to only the fields event.code and observer.hostname.

As a result, the output will contain exclusively the specified fields.

source network_indexes
| fields event.code, observer.hostname

---

Example 2

In this example, food_orders contains information about orders.

As a result of executing this query, all fields type and operation_status will be displayed. The type field is enclosed in quotes so that the interpreter correctly recognizes the field name.

source food_orders
| fields - 'type', operation_status 

---

Example 3

The source winevents contains Windows event logs. In this example, wildcards are used to filter fields:

• event* — selects all fields starting with the prefix event
• *target* — selects all fields containing the substring target

source winevents
| fields event*, *target*

---

Example 4

The source web_indexes contains network requests to the web server.

This example demonstrates comprehensive data processing:

1. The table command forms a tabular output with the specified fields
2. The eval command calculates the response body size in kilobytes and saves the result in the field kbytes
3. The fields command with the - prefix excludes unnecessary fields from the result

source web_indexes 
| table @timestamp, user.name, user_agent.name, url.path, http.response.status_code, http.response.body.bytes
| eval kbytes=if(isnull(http.response.body.bytes), "-", round(http.response.body.bytes/1024))
| fields - http.response.body.bytes, *status*, user*

The result of executing the query will be a table containing only the remaining fields:

kbytes	@timestamp	url.path
10	2025-05-30T17:42:39.729492Z	/walk/stove
45	2025-05-30T17:41:53.013623Z	/drink.jpg
9	2025-05-30T17:41:06.937597Z	/fuel
12	2025-05-30T17:42:24.324308Z	/quilt
47	2025-05-30T17:38:23.999864Z	/drink.ico

---

Example 5

In this example, the wildcard event.* excludes the entire group of nested fields starting with event.:

source radius_logs
| fields - event.*