Events within LogScale contain multiple fields, and each field contains a corresponding value. New fields can be created at any point within the query process- stored event data is dependent on how the event is ingested. The exact format and structure of stored data in LogScale is impacted by a combination of factors:

The specific fields extracted also depend on which fields the parser is configured to create as tags. Tagged fields affect how events are indexed and queried within LogScale.

Common fields that appear in all events include:

The following examples show how different fields and their values may differ based on raw event data that is ingested, their source, and the parser used:

The fields extracted from each event depend on the parser applied to the incoming data. Parsers can be configured to designate certain fields as tags, which affects how the data is indexed and queried. For more information on parsers and field extraction, see Parse Data.