In LogScale, you can search either the raw data of events or the fields extracted from the event when the data is parsed.

An event is the smallest fragment of data in LogScale. Events are the basis of all storage and queries. Collections of events are stored in repositories. When querying data, the query is executed on a sequence of those events across a given time range.

Each event may have a different set of fields, a different schema, and this is valid. For example, in the HTTP log example there is no authentication or user, but there could be lines in the log that contain that information. LogScale does not use or require a fixed schema for storing the data, and you do not to define the data structure, validation or indexes before the data can be ingested.

A single repository may therefore contain multiple source log data consisting of different formats, and events. This flexibility enables you to query multiple log files simultaneously and the query language provides a powerful mechanism for filtering and formatting the data.

LogScale also stores the original @rawstring of the log line. This is because the parser may pick specific fields of information but not handle all the different formats. Because we don't want to worry about these differences or lose the data, that original log line is stored and can be queried and processed when searching.

There are different kinds of fields coming from the events:

Event fields can be viewed and managed from the LogScale User Interface. See Search Data.

For more information on how to query event fields in LogScale and discover what you can achieve with query writings, see Query Management and Common Queries.