Search Arkime expression fields
arkime_field_searchRead-only
Discover the field spellings Arkime routes accept before writing queries, returning expression, database, type, and group columns with help text.
Instructions
Discover the field names Arkime's routes accept — call before writing one.
Arkime names the same field more than once, and which spelling a
parameter wants is decided per PARAMETER, not per tool. This is the
field-discovery tool for every arkime_* tool, as malcolm_field_search
is for the malcolm_* ones. Returns "exp | db | type | group" lines with
the help text. Route the two columns like this:
- "exp" (ip.src, port.dst, protocols): every `expression` argument, and
the field lists of arkime_unique, arkime_multiunique and
arkime_spigraphhierarchy. exp=srcIp,dstIp gets the body "Unknown
expression srcIp" under HTTP 200 from multiunique and HTTP 403 from
spigraphhierarchy, so those three parameters reject a db name before
the request rather than pass it on.
- "db" (srcIp, dstPort, node): arkime_connections' src_field and
dst_field, and nothing else. ip.src/dstIp gets HTTP 403 and
srcIp/port.dst HTTP 500.
- A THIRD spelling, the storage path, is what arkime_spigraph's field
and arkime_spiview's spi take. It is the same string as the db column
for most fields; the few that print a camelCase db alias store under
a dotted name instead — srcIp is source.ip, dstPort is
destination.port, totBytes is network.bytes, dstGEO is
destination.geo.country_iso_code — and the dotted one is what those
two parameters want.
A dotted storage path is also accepted wherever the exp column is:
exp=destination.port returns the same unique lines as exp=port.dst,
while exp=dstPort returns none. It is the one spelling that answers on
every route.
The catalogue is far bigger than a keyword suggests, so the list
usually stops at `limit` and says "... and N more". Read a field you
cannot see as "not on this page" rather than absent, and narrow with
group instead of raising limit.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| group | No | Exact Arkime field group to restrict to, e.g. "http", "dns", "tls", "general". Empty = any group. | |
| limit | No | Max fields to return. | |
| keyword | No | Substring matched against the expression name, db name and help text, e.g. "user", "cert", "ja3". Empty = no keyword filter. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |