Search index fields
malcolm_field_searchRead-only
Find and confirm field names in Malcolm's index by keyword, prefix, or type before running queries, avoiding non-standard naming issues.
Instructions
Discover which field NAMES exist in Malcolm's index, by keyword, prefix, or type.
Use this first, before any query, to confirm a field name exists — Malcolm uses
non-standard names (e.g. http.useragent, NOT http.user_agent). To then see the
VALUES a field holds, use malcolm_field_values; to see which datasets contain
it, use malcolm_field_profile. Do NOT source an arkime_* argument from here:
these are the names malcolm_* and search_dsl take, and Arkime has its own
spelling for the same field (ip.src, srcIp) that arkime_field_search reports.
Pass at least one argument. Returns a text list of "name (type)" lines,
sorted alphabetically.
Arguments narrow (AND), they never widen, and the mapping is big enough
that one keyword rarely lands: it runs to thousands of fields, and a
keyword as common as "ip" matches over a thousand of them on its own.
The header line counts every match but only the first 100 names are
printed, so add a prefix or a field_type rather than reading the printed
list as the whole answer.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| prefix | No | Field-name prefix to match, e.g. "zeek.dns", "suricata.alert", "rule". Empty = no prefix filter. | |
| keyword | No | Substring to match anywhere in a field name, e.g. "useragent", "signature". Empty = no keyword filter. | |
| field_type | No | Filter by the type Malcolm reports for a field — measured on Malcolm v26.07.1 those are "string", "integer", "float", "date", "ip" and "geo". They are NOT OpenSearch type names: "keyword", "long" and "text" match nothing here, even though index_mapping reports the same fields under those names. Empty = any type. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |