Field is the name of the field as it comes from the events.

Field as link is used with fields that contain URLs to display clickable links.

Custom link creates arbitrary links based on the contents of an event. Instead of just providing a field name, and using its content as the link, you write link templates, and use field interpolation to fill out the template.

To use field interpolation, write two sets of curly braces (one nested in the other), and write fields ["nameOfField"] inside, like this: https://internal-tool/customers/{{fields["customerId"]}}. This creates a unique link for every value of customerId.

The same mechanism can also be used to generate the text for the link, if you would like a different text than the raw URL to show as the link.

Figure 71. Adding a New Custom Link Column

Field list is used to format all fields in an event as a list of key-value pairs. Enable the Group fields by prefix checkbox to organize data that share a prefix into a tree-structure. A prefix is any string followed by a dot in the field name, as actor in actor.ip and actor.organizationId, for instance.

Figure 72. Group fields by prefix option

In the following example, all fields prefixed with actor. and user. are grouped in a tree that can be expanded or collapsed.

Figure 73. Field List grouped by prefix