Field @rawstring

Falcon LogScale represents the original text of the event in the @rawstring attribute. By keeping the original data, nothing is thrown away during ingestion of the data. This allows for:

  • Free-text searching across all logs

  • Field extraction after content has been located

  • Identification of previously unknown important data patterns