# Logs and no-index fields
**URL:** https://discuss.elastic.co/t/logs-and-no-index-fields/331009
**Category:** Elastic Observability
**Tags:** ecs-elastic-common-schema
**Created:** [April 28, 2023, 4:09am UTC](https://discuss.elastic.co/t/logs-and-no-index-fields/331009 "2023-04-28T04:09:49Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@rsk0](https://discuss.elastic.co/u/rsk0)
#### Post date: [April 28, 2023, 4:09am UTC](https://discuss.elastic.co/t/logs-and-no-index-fields/331009/1 "2023-04-28T04:09:49Z")
Has anyone implemented a no-indexing strategy for their logs customers?
Meaning, I’d like to allow my customers to insert arbitrary data/structure, but not consume from the finite field count resource, so I want to map fields as `index: false`. The question is _which fields_? I'm wanting not to conflict with ECS.
I’m considering:
- adding a tree where customers can dump info: `ACME.noindex.*`
- specifying a prefix for fields that don’t get indexed: ` __` for example, as in `__ optype`, `service.node. __package_hash` or `__ myDogsActivityPreferences.indoors.morning`
---
### Author:  [@coenwarmer](https://discuss.elastic.co/u/coenwarmer)
#### Post date: [May 1, 2023, 7:48am UTC](https://discuss.elastic.co/t/logs-and-no-index-fields/331009/2 "2023-05-01T07:48:00Z")
Hey there @rsk0,
Both are viable options to get what you want.
If you have concerns over potential collisions with ECS fields, please check with [the ECS documentation](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) to get an overview of field names.
Thank you,
Coen Warmer
---
### Author:  [@rsk0](https://discuss.elastic.co/u/rsk0)
#### Post date: [May 1, 2023, 4:13pm UTC](https://discuss.elastic.co/t/logs-and-no-index-fields/331009/3 "2023-05-01T16:13:22Z")
Thanks so much for your feedback.
I've been trying to make sure I understand ECS since we're using it as our foundation. The naming of my "no-index tree" option uses [uppercase so as not to conflict](https://www.elastic.co/guide/en/ecs/current/ecs-custom-fields-in-ecs.html#_capitalization), and the double underscore prefixing tries also to make use of [guidelines](https://www.elastic.co/guide/en/ecs/current/ecs-guidelines.html#_guidelines_for_field_names) and [best practices](https://www.elastic.co/guide/en/ecs/current/ecs-custom-fields-in-ecs.html) while carving out something special that's not yet handled by ECS.
Now that I think about it, I should make sure to encourage proper naming of fields even if they're marked no-index by ` __`. They may not be indexed now, but if they are switched to be indexed in the future we'll want the names conforming to ECS practices. So, `__ myDogsActivityPreferences.indoors.morning` should be `__my_dogs_activity_preferences.indoors.morning`.
Do you think ECS might in the future designate space, somehow, for non-indexing data? Is that more a question for @ebeahan or @webmat?
[Edit: We are leaning towards using the `__` designator for non-indexing fields.]