Skip to main content
Sumo Logic

fields

The fields operator allows you to choose which fields are displayed in the results of a query. Use a fields operator to reduce the "clutter" of a search output that contains fields that aren't completely relevant to your query.

There are two fields operator modes: whitelist and blacklist. Fields are also returned differently depending on whether your query is a non-aggregate or aggregate query. And the column sort order is handled differently for non-aggregate or aggregate queries.

Whitelist

For whitelist mode, only fields you specify for inclusion are kept in the search output. For example, to strip out every field except for method and status_code, your query would be:

_sourceCategory=Apache/Access 
| parse using public/apache 
| fields method, status_code

The search results would look like this:

Fields

Whitelist queries allow all system internal fields (fields prefixed with an underscore "_") to pass.

Blacklist

For blacklist mode, all fields except for those you explicitly remove remain in the search output. Blacklist mode is indicated with a minus sign "-" in a query. For example, to only remove the log_level, module, and process_id fields, your query would be:

_sourceCategory=*apache* 
| parse using public/apache 
| fields - log_level, module, process_id

 

Blacklist queries will also remove internal fields (fields prefixed with an underscore "_") when specified. For example:

_sourceCategory=*apache* 
| parse using public/apache 
| count by size 
| fields - _count

Make sure that your query does not repeat or duplicate individual fields, or your search query will fail. 

Non-aggregate vs. Aggregate Query Results

The fields displayed in query results are different for non-aggregate and aggregate queries.

For example, by default, all non-aggregate query results, which appear in the Messages tab, include the # (results list number), Time, and Message field, along with any other fields you have whitelisted in your query.

Aggregate query results, which appear in the Aggregates tab, include only the fields that you have specified in your query.

For example, for this non-aggregate query:

_sourceCategory=Apache/Access
| parse using public/apache
| fields method, status_code

The search results would look like this:

Fields

While the same query with an added count by statement to make it an aggregate query:

_sourceCategory=Apache/Access
| parse using public/apache
| count by method, status_code
| fields status_code, method

This would provide the following results:

Non-Aggregate vs Aggregate Column Sort Order

By default, the left-to-right field and column order in a non-aggregate result is alphabetical based on field name. 

For example, if you used:

| fields status_code, method

Sumo Logic displays the method field first, then the status_code field second.

In an aggregate result, field and column order follows the requested order of the query. 

For example, if you used: 

| count by status_code, method

Sumo Logic display the status_code field first, and the method field second.