Selection and modification commands

Syntax

| fields fieldName [= Expression] [, ...]
Example

In the following example, only three of all available fields returned from the fetch stage are selected. The loglevel field is additionally converted to lowercase by the DQL lower function.
```
1fetch logs
2| fields timestamp, severity = lower(loglevel), content
```
Additionally, the fields command ensures that the order of fields in the query output aligns with the order specified in the query.

Syntax

| fieldsAdd fieldName [= Expression] [, ...]
Example

The following example shows the difference between fields and fieldsAdd. While the fields command defines the result table by the fields specified, the fieldsAdd command adds new fields to the existing fields.
```
1fetch logs
2| fieldsAdd severity = lower(loglevel)
```

Syntax

fieldsKeep fieldNameOrPattern [,...]
Example

The following example uses the fieldsKeep command to keep the timestamp, content and all fields with their name starting with dt.entity.
```
1fetch logs
2| fieldsKeep timestamp, content, "dt.entity.*"
```

Syntax

| fieldsRemove fieldNameOrPattern [,...]
Example

The following example uses the fieldsAdd command to generate a new field called severity. In order to reduce the duplicated information that is still present in the loglevelfield, the fieldsRemove command is used to remove the original loglevel field.
```
1fetch logs
2| fieldsAdd severity = lower(loglevel)
3| fieldsRemove loglevel
```

Example

1fetch logs
2| fieldsAdd severity = lower(loglevel)
3| fieldsRemove loglevel, 'k8s.cluster.*'

Example

1fetch logs
2| fieldsRename severity=loglevel, source=log.source, logmessage = content