Identifiers

A regular identifier is a string of characters that starts with an ASCII letter (lower or upper case). The next character can either be a letter, digit, or underscore (_). It can’t be a reserved keyword. Whitespace and other special characters are also not allowed.

OpenSearch supports the following regular identifiers:

1. Identifiers prefixed by an @ sign. Use for meta fields generated by Logstash ingestion.
2. Identifiers with hyphen - in the middle. Use for index names with date information.
3. Identifiers with star * present. Use for wildcard match of index patterns.

A delimited identifier can contain special characters not allowed by a regular identifier. You must enclose delimited identifiers with back ticks (``). Back ticks differentiate the identifier from special characters.

If the index name includes a dot (.), for example, , use delimited identifiers with back ticks to escape it `log-2021.01.11`.

1. Identifiers with a . present. Similarly, - to include date information.
2. Identifiers with other special characters. For example, Unicode characters.

To quote an index name with back ticks:

source=`accounts` | fields `account_number`;

Identifiers are case sensitive. They must be exactly the same as what’s stored in OpenSearch.