Search Arkime expression fields
arkime_field_searchRead-only
Search Arkime's field catalog to find the correct field names for queries. Returns expression, database, type, and group details to prevent invalid-field errors.
Instructions
Discover the field names Arkime's routes accept — call before writing one.
Arkime names the same field more than once, and which spelling a
parameter wants is decided per PARAMETER, not per tool. This is the
field-discovery tool for every arkime_* tool, as malcolm_field_search
is for the malcolm_* ones. Returns "exp | db | type | group" lines with
the help text. Route the two columns like this — every number measured
on Malcolm v26.07.1 over one 24-hour window:
- "exp" (ip.src, port.dst, protocols): every `expression` argument, and
the field lists of arkime_unique, arkime_multiunique and
arkime_spigraphhierarchy. exp=ip.src,ip.dst returned 692 multiunique
rows and 140 spigraphhierarchy table rows; exp=srcIp,dstIp returned
the body "Unknown expression srcIp" under HTTP 200 from multiunique
and HTTP 403 from spigraphhierarchy, so those three parameters reject
a db name before the request rather than pass it on.
- "db" (srcIp, dstPort, node): arkime_connections' src_field and
dst_field, and nothing else. srcIp/dstIp returned a 10-node graph;
ip.src/dstIp returned HTTP 403 and srcIp/port.dst HTTP 500.
- A THIRD spelling, the storage path, is what arkime_spigraph's field
and arkime_spiview's spi take. It is the same string as the db column
for 4,034 of the 4,051 fields here; the other seventeen print a
camelCase db alias and store under a dotted name instead — srcIp is
source.ip, dstPort is destination.port, totBytes is network.bytes,
dstGEO is destination.geo.country_iso_code — and the dotted one is
what those two parameters want.
A dotted storage path is also accepted wherever the exp column is:
exp=destination.port returned the same 10,000 unique lines as
exp=port.dst and exp=network.bytes 5,544, while exp=dstPort returned
none. It is the one spelling that answers on every route.
The catalogue is far bigger than a keyword suggests — measured on
v26.07.1: 4,051 fields, of which 942 match "ip" and 114 match "http" —
so the list usually stops at `limit` and says "... and N more". Read a
field you cannot see as "not on this page" rather than absent, and
narrow with group, of which this deployment has 192, instead of raising
limit.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| group | No | Exact Arkime field group to restrict to, e.g. "http", "dns", "tls", "general". Empty = any group. | |
| limit | No | Max fields to return. | |
| keyword | No | Substring matched against the expression name, db name and help text, e.g. "user", "cert", "ja3". Empty = no keyword filter. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |