Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Elasticsearch : Meaning of "@" symbol

So I haven't been able to find anything in the Elasticsearch documentation regarding the meaning of using a @ prefix for field names (if there is a doc about this, my question might have an easy answer).

I've seen it used in cases where the field represents something about the log line - easy example being @timestamp, in the case of AWS Cloudwatch logs to AWS Elasticsearch Service it passes things like @log_group, @id, etc.

It would be interesting to know if using the @ symbol is simply a naming convention (someone decided to distinguish log line meta information from pertinent fields), or if there is some kind of functional difference in prefixing the field name with @.

Any insight (or answers)?

like image 650
coleman-benjamin Avatar asked Aug 25 '16 19:08

coleman-benjamin


2 Answers

@ doesn't have a special meaning inside Elasticsearch.

Logstash uses this convention to define some "metadata" fields for the events, like @timestamp and @version.

like image 96
Andrei Stefan Avatar answered Nov 19 '22 05:11

Andrei Stefan


Really i don't find any official documentation about this in Elasticsearch, but, i find that some libraries who uses Elasticsearch results points @ as a annotation, to specify what's the _timestamp for example.

For example, as explain in this issue, the Grafana uses the @timestamp annotation for default, and if you use a custom timestamp you will need to specify they.

like image 41
Lucas Queiroz Ribeiro Avatar answered Nov 19 '22 05:11

Lucas Queiroz Ribeiro