Search index fields
malcolm_field_searchRead-only
Search Malcolm's index for field names by prefix, keyword, or type. Use this to verify field names before querying.
Instructions
Discover which field NAMES exist in Malcolm's index, by keyword, prefix, or type.
Use this first, before any query, to confirm a field name exists — Malcolm uses
non-standard names (e.g. http.useragent, NOT http.user_agent). To then see the
VALUES a field holds, use malcolm_field_values; to see which datasets contain
it, use malcolm_field_profile. Do NOT source an arkime_* argument from here:
these are the names malcolm_* and search_dsl take, and Arkime has its own
spelling for the same field (ip.src, srcIp) that arkime_field_search reports.
Pass at least one argument. Returns a text list of "name (type)" lines,
sorted alphabetically.
Arguments narrow (AND), they never widen, and the mapping is big enough
that one keyword rarely lands: it runs to thousands of fields, and a
keyword as common as "ip" matches over a thousand of them on its own.
The header line counts every match but only the first 100 names are
printed, so add a prefix or a field_type rather than reading the printed
list as the whole answer.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| prefix | No | Field-name prefix to match, e.g. "zeek.dns", "suricata.alert", "rule". Empty = no prefix filter. | |
| keyword | No | Substring to match anywhere in a field name, e.g. "useragent", "signature". Empty = no keyword filter. | |
| field_type | No | Filter by the type Malcolm reports for a field — measured on Malcolm v26.07.1 those are "string", "integer", "float", "date", "ip" and "geo". They are NOT OpenSearch type names: "keyword", "long" and "text" match nothing here, even though index_mapping reports the same fields under those names. Empty = any type. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |