Any field that is not a tag or metadata is a user field. They are extracted at ingest by a parser. Data is extracted either by using character separated value parsing, JSON parsing or regular expressions to identify key parts of each line.