# Documentation, Fields in $message

**URL:** <https://community.graylog.org/t/documentation-fields-in-message/15497>\
**Category:** Graylog Central (peer support)\
**Created:** [May 18, 2020, 11:01pm UTC](https://community.graylog.org/t/documentation-fields-in-message/15497 "2020-05-18T23:01:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![arrmo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arrmo/32/6315_2.png) [@arrmo](https://community.graylog.org/u/arrmo)\
**Post date:** [May 18, 2020, 11:01pm UTC](https://community.graylog.org/t/documentation-fields-in-message/15497/1 "2020-05-18T23:01:38Z")

</div>

Hi,

I’m trying to add some rules to a pipeline - I searched through the documentation, and did find information on the functions that are available for rules ([https://docs.graylog.org/en/3.2/pages/pipelines/functions.html](https://docs.graylog.org/en/3.2/pages/pipelines/functions.html)) … but, I’m still struggling to find what the field names are inside a $message. Does anyone have any pointers?

Thanks!

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 19, 2020, 9:36am UTC](https://community.graylog.org/t/documentation-fields-in-message/15497/2 "2020-05-19T09:36:12Z")

</div>

he @arrmo

those fieldnames are unique for each installation - kind of.

When you send in structured logs the field names are created by the application that send in the data. Syslog messages have some fields that are defined for syslog, like facility, severity and application.

Because this can be seen as a key-value pair or like the table head in your sheet this can’t be named in any kind of documentation.

---

<div class="post-metadata">

**Author:** ![arrmo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arrmo/32/6315_2.png) [@arrmo](https://community.graylog.org/u/arrmo)\
**Post date:** [May 19, 2020, 10:50am UTC](https://community.graylog.org/t/documentation-fields-in-message/15497/3 "2020-05-19T10:50:15Z")

</div>

Hi,

Thanks for the quick reply! That makes sense, no issue … but any pointers / suggestions to figure out what keys have been assigned (i.e. what names to use to access the data)?

Thanks again.

---

<div class="post-metadata">

**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\
**Post date:** [May 19, 2020, 11:51am UTC](https://community.graylog.org/t/documentation-fields-in-message/15497/4 "2020-05-19T11:51:20Z")

</div>

Look at the message you’re writing the rule for, look for the field you’re interested in.  
The field name shown in the message will be what you’re looking for.

---

<div class="post-metadata">

**Author:** ![arrmo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arrmo/32/6315_2.png) [@arrmo](https://community.graylog.org/u/arrmo)\
**Post date:** [May 19, 2020, 12:58pm UTC](https://community.graylog.org/t/documentation-fields-in-message/15497/5 "2020-05-19T12:58:00Z")

</div>

Hi,

Do you mean in the Graylog interface? I can definitely see fields “missing” there (like gl2\_remote\_ip, for example). Thinking that I could use the Elasticsearch API perhaps, calling it with the full message number … would what work? Just not sure of the syntax to use for that.

Thanks!

---

<div class="post-metadata">

**Author:** ![arrmo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arrmo/32/6315_2.png) [@arrmo](https://community.graylog.org/u/arrmo)\
**Post date:** [May 19, 2020, 5:56pm UTC](https://community.graylog.org/t/documentation-fields-in-message/15497/6 "2020-05-19T17:56:57Z")

</div>

FYI, to share, help others with this later (and it may be what you’re meaning!) … if you run an Elasticsearch query, with a search of \_id:(the full / actual messge UID) =\> the (curl / API) output will show you all the available parameters (keys).

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 2, 2020, 5:56pm UTC](https://community.graylog.org/t/documentation-fields-in-message/15497/7 "2020-06-02T17:56:57Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.