ELK stack version: v7.x ... latest (Elasticsearch + Kibana + Filebeat)
there are fields in the
I would like to add custom fields with names starting with an underscore like
_myfield to my documents.
Where could I check that my underscored field names won't conflict with the ELK's predefined ones?
BTW I would like to do that because I'd like to sort some more important fields up in the fields list (alphabetical order) when I expand a document in Kibana/Discover
I don't think we have anything fully documented on this sorry to say.
I think you've covered most of them though.
thank you for your reply!
Do you think
_myimportantfield would be a bad practice? and
Or is there any more proper way to elevate important fields top of the field list in Kibana/Discover view?
Both of those are possible to create in Elasticsearch, maybe the use of
! might be a clearer indicator that this is not an Elasticsearch meta/reserved field. We don't really have guidelines or best practises around this sort of thing.