# Field name limitations

**URL:** <https://discuss.elastic.co/t/field-name-limitations/355522>\
**Category:** Elasticsearch\
**Tags:** ecs-elastic-common-schema\
**Created:** [March 15, 2024, 10:09pm UTC](https://discuss.elastic.co/t/field-name-limitations/355522 "2024-03-15T22:09:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rsk0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rsk0/32/124810_2.png) [@rsk0](https://discuss.elastic.co/u/rsk0)\
**Post date:** [March 15, 2024, 10:09pm UTC](https://discuss.elastic.co/t/field-name-limitations/355522/1 "2024-03-15T22:09:00Z")

</div>

I'm wondering **what the limitations are for field names**. I've seen some crazy things in our dynamic mappings, so I bet Lucene and ES are super flexible.

**For example, can you use a leading underscore?**

I notice that [ES metadata fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-fields.html) have the convention of starting with an underscore. We'll try to be careful not to collide with those, of course.

(We're also using ECS, so I'll avoid existing fields/sets or base fields and will follow [the guidelines](https://www.elastic.co/guide/en/ecs/current/ecs-guidelines.html).)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 16, 2024, 2:46am UTC](https://discuss.elastic.co/t/field-name-limitations/355522/2 "2024-03-16T02:46:59Z")

</div>

I'm not sure if there are any or what the limitations for field names are, but there are some things that I would avoid.

For example I would avoid having spaces, square brackets and curly brackets in the field names.

I would also avoid using dots in the field name as this can lead to confusion if the dot is part of the field name or if it indicates that it as nested object.

Leading underscores are no issue, I use them on target fields for logstash parsing filters like the `json`, `kv` and `csv` filters.

In this case when I parse a json for example, it will expand its fields nested under a field starting with an underscore, like `_json`, and I map this field as `flattened`.

---

<div class="post-metadata">

**Author:** ![rsk0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rsk0/32/124810_2.png) [@rsk0](https://discuss.elastic.co/u/rsk0)\
**Post date:** [March 18, 2024, 7:08pm UTC](https://discuss.elastic.co/t/field-name-limitations/355522/3 "2024-03-18T19:08:34Z")

</div>

> For example I would avoid having spaces, square brackets and curly brackets in the field names.

Good point.

> I would also avoid using dots in the field name as this can lead to confusion if the dot is part of the field name or if it indicates that it as nested object.

Good point.

> Leading underscores are no issue, I use them on target fields for logstash parsing filters like the `json`, `kv` and `csv` filters.

Good info, thanks for the input.

So maybe other than avoiding the existing metadata field names

- \_index
- \_id
- \_source
- \_size
- \_doc\_count
- \_field\_names
- \_ignored
- \_routing
- \_meta
- \_tier

it might be good to avoid terms that might become future metadata fields. I probably shouldn't create fields called `_schema` or `_shard` or `_node`.

And if I don't want to put in the effort to think carefully about whether a term might become a future metadata field, I could probably default to using all-caps names as another way of helping avoid collision. `_LOGS`, for example.

We probably also want to avoid Logstash-internal fields or Elastic Agent fields like `@metadata`.

It feels like the `@` — at sign — was intended by folks at different points to carve out spaces for reserved use (`@timestamp`, `@metadata`), so probably best to avoid that as a start character.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2024, 7:09pm UTC](https://discuss.elastic.co/t/field-name-limitations/355522/4 "2024-04-15T19:09:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.