Reserved Field Names and Keywords

The Anomali Security Analytics log parser leverages Logstash. Logstash is an open-source server-side data processing pipeline that is a component of many widely used data management systems. The following tables provides a list of Logstash keywords that you should avoid when you are adding field names, or you are specifying a pattern in the field for a custom log source.

Reserved Name	Usage
dsname dstype	These field names are reserved and used internally by Logstash.
host	The field name `host` is a reserved field name used by Logstash. Instead, use `host1` or something similar.
internal_dstype internal_dsname	These field names are reserved and used internally by Logstash.
message	The field name `message` is the field name used by Logstash to hold the original log message. Using this name as a new field overwrites the original message (Sample Line) contained in the field.
raw_event	This field name is reserved and used internally by Logstash.
tags	This field name is reserved and used internally by Logstash.
@timestamp timestamp1	These field names are reserved and used internally by Logstash.
@version	This field name is reserved and used internally by Logstash.