Fields
Fields
Types, the 4,096 cap, and how to inspect what a dataset actually contains.
A field is a column discovered from your events. You do not create them; you inspect them.
| Type | Recognised from | LSQL cast |
|---|---|---|
string | JSON string | tostring() |
integer | Whole JSON number | toint() |
float | Fractional JSON number | todouble() |
boolean | true / false | — |
datetime | RFC 3339 string or unix number in a time field | todatetime() |
array | JSON array | index with field[0] |
object | Nested JSON, flattened to dot paths | address as ['a.b'] |
Inspecting a dataset
curl https://api.logstreem.com/v1/datasets/api-gateway-prod/fields \
-H "Authorization: Bearer $LOGSTREEM_TOKEN"The 4,096 cap
A dataset holds at most 4,096 distinct fields. Past that, ingest returns 400 field_limit_exceeded for events carrying new keys — existing fields keep working, so this degrades rather than breaks.
The cap is almost always a bug in a sender
4,096 genuinely distinct fields is a lot. Hitting it usually means an id is being used as a key. Find the culprit by listing fields and sorting by first-seen — the offender arrives in a burst.