A temporary field is a field that exists as part of a query, but is not saved globally within a Log Insight instance or as part of an installed content pack.

Log Insight reduces the chances of creating a temporary field by automatically updating the query that relies on a field being modified.


If you delete a field that a saved query relies on, the saved query contains a temporary field.

You can see temporary fields when you run a saved query in the Interactive Analysis page and a field used in the saved query contains the namespace Temporary to the right of the field name.

Queries to contain one or more fields. For saved queries in Log Insight the field definition used when a query is saved will be modified if the field is modified. Field modifications include

Changing the field value

Changing the regex before value and the regex after field value

Changing the name of the field

Deleting the field

When you export a content pack Log Insight converts all temporary fields to content pack fields. If you see a temporary field in a content pack, you might be looking at a content pack from a previous product version that is exported with temporary fields, or the content pack is manually edited.