Reserved underscore field names

Elastic Stack Elasticsearch
1

Hello,

ELK stack version: v7.x ... latest (Elasticsearch + Kibana + Filebeat)

there are fields in the documents like _id, _index, _score, _type .

I would like to add custom fields with names starting with an underscore like _myfield to my documents.

Where could I check that my underscored field names won't conflict with the ELK's predefined ones?

BTW I would like to do that because I'd like to sort some more important fields up in the fields list (alphabetical order) when I expand a document in Kibana/Discover

2

I don't think we have anything fully documented on this sorry to say.

I think you've covered most of them though.

1 Like
3

thank you for your reply!

Do you think _myimportantfield would be a bad practice? and !myimportantfield ?

Or is there any more proper way to elevate important fields top of the field list in Kibana/Discover view?

4

Both of those are possible to create in Elasticsearch, maybe the use of ! might be a clearer indicator that this is not an Elasticsearch meta/reserved field. We don't really have guidelines or best practises around this sort of thing.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.