Log Collector Metadata

Each event has metadata attached on ingestion. All metadata fields start with @ for easy identification. All events contain the following metadata fields by default.

Metadata Field Description
@collect.host The name of the ingesting host.
@collect.id The unique ID of the collector.
@collect.timezone Timezone.
@collect.timezone_offset The UTC timezone offset. This field is useful in LogScale queries with functions such as findTimestamp in the timezoneField parameter.
@collect.timestamp Timestamp.
@collect.source_name The name of the source.
@collect.source_type (For example, cmd, file, journald, syslog, syslog_tls, unifiedlog, wineventlog).
@collect.error Error occurred while collecting data, for example, wineventlog: could not parse names for event data.

The following additional metadata fields are source specific.

Source Metadata Field Description
journald @collect.unit The name of the unit, for example, ntp.service.
file @collect.file The file name from where the collector collects the event.
wineventlog @collect.channel Channel of the collected event.
syslog @collect.remote Remote IP address and port.
@collect.socket The local socket, for example, :514/UDP.
command @collect.cmd The command that the collector executes.
@collect.pid The PID of the executed command.
@collect.stream The output stream of the executed command, stdout or stderr.
file_snapshot @collect.file The file name from where the collector collects the event.
@collect.modified The modification time in epoch milliseconds.
@collect.line Added when addLineNumber: true; counts lines (or records in sap mode).