FAQ: Does it matter where a tagged field search occurs in a query?

It doesn't. LogScale identifies tagged fields (those with #) and processes them before standard fields, regardless of their position in the query. For example, these two queries would work the same:

logscale
HOST=name1 
| PROGRAM=test 
| #FIELD=testdata
logscale
#FIELD=testdata 
| HOST=name1 
| PROGRAM=test

Placing filtering conditions early in your query can help reduce the number of events that need processing later in the query execution. Filtering includes tagged fields as well as standard field filters.

Placing any case statements or match() functions after any tag or field filtering will also improve the query performance.