fields

Use fields to show specific fields in query results.

If your query contains multiple fields commands and doesn't include a display command, the results display all of the fields that are specified in the fields commands.

Example: Display specific fields

The following example shows a query that returns 20 log events and displays them in descending order. The values for @timestamp and @message are shown in the query results.

fields @timestamp, @message
| sort @timestamp desc
| limit 20 

Use fields instead of display. when you want to use the different functions and operations supported by fields for modifying field values and creating new fields that can be used in queries.

You can use the fields command with the keyword as to create extracted fields that use fields and functions in your log events. For example, fields ispresent as isRes creates an extracted field named isRes, and the extracted field can be used in the rest of your query.