Indexes

An index holds your logs and defines a schema that determines how each field is stored and queried. When you attach an existing Quickwit instance, its indexes appear in Rootprint automatically.

Built-in OpenTelemetry index

Rootprint ships with otel-logs-v0_9, the OpenTelemetry logs index bundled with Quickwit 0.9.1. Its schema maps directly to the OpenTelemetry Log Data Model. Rootprint’s default field-role mappings match it, so it works without configuration.

Schema

The index uses strict mode: Quickwit rejects any document with a top-level field outside the schema. Omitted fields are allowed. Put custom key-value data in the attributes, resource_attributes, or scope_attributes JSON fields. When you use an OpenTelemetry collector, Quickwit maps fields automatically. In the Search columns below, indexed fields are searchable and fast fields support range queries, aggregations, and sorting. See Indexed, stored, and fast. For how the raw and default tokenizers match, see Tokenizers and case sensitivity.

Core fields

These fields carry the primary log data.

Field	Type	Search	Description
`timestamp_nanos`	`datetime`	fast	Timestamp in nanoseconds UTC. Primary time field for range filtering.
`observed_timestamp_nanos`	`datetime`	indexed	When the collector observed the event.
`severity_text`	`text`	indexed, fast	Log level (`INFO`, `ERROR`). Raw tokenizer — exact match.
`severity_number`	`u64`	indexed, fast	Numeric log level: 1-4 TRACE, 5-8 DEBUG, 9-12 INFO, 13-16 WARN, 17-20 ERROR, 21-24 FATAL.
`body`	`json`	indexed	Log message body. Default tokenizer — full-text searchable.
`service_name`	`text`	indexed, fast	Derived from `resource_attributes["service.name"]`. Raw tokenizer.

Attributes

Key-value metadata on the log event and its resource.

Field	Type	Search	Description
`attributes`	`json`	indexed, fast	Log record metadata. Raw tokenizer, `expand_dots` enabled.
`resource_attributes`	`json`	indexed, fast	Infrastructure metadata (host, k8s, cloud). Same as `attributes`.
`dropped_attributes_count`	`u64`	—	Dropped log record attributes count.
`resource_dropped_attributes_count`	`u64`	—	Dropped resource attributes count.

Trace context

A log carrying trace_id opens its trace. See Read a trace. If your custom schema keeps the trace ID elsewhere, set the index’s Trace ID field. See Correlate logs with traces.

Field	Type	Search	Description
`trace_id`	`bytes`	indexed	16-byte trace ID in hex.
`span_id`	`bytes`	indexed	8-byte span ID in hex.
`trace_flags`	`u64`	—	W3C trace flags bitmask. Stored only.

Instrumentation scope

Metadata about the library that produced the log. Stored only: visible in results, not searchable.

Field	Type	Description
`scope_name`	`text`	Instrumentation library name.
`scope_version`	`text`	Instrumentation library version.
`scope_attributes`	`json`	Scope-level key-value metadata.
`scope_dropped_attributes_count`	`u64`	Dropped scope attributes count.

Example payload

{
	"timestamp_nanos": 1776340800000000000,
	"observed_timestamp_nanos": 1776340800000000000,
	"severity_text": "INFO",
	"severity_number": 9,
	"body": { "message": "User logged in" },
	"service_name": "frontend",
	"attributes": { "user_id": "alice" },
	"resource_attributes": { "service.name": "frontend", "host.name": "node-1" },
	"trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
	"span_id": "00f067aa0ba902b7",
	"trace_flags": 1,
	"dropped_attributes_count": 0,
	"resource_dropped_attributes_count": 0,
	"scope_name": "my-library",
	"scope_version": "1.0.0",
	"scope_attributes": {},
	"scope_dropped_attributes_count": 0
}

Custom indexes

For non-OpenTelemetry data (audit trails, custom application events, third-party log formats), create an index with the schema your data needs. See Create a custom index for the Create-index form: field types, tokenizers, and retention policy. Once it exists, configure how Rootprint maps its fields from the index’s Configuration tab.

Next steps

Send logs to start ingesting data into any index.
Search query syntax to learn what users can type in the search box.

Get Started

Send Logs

Traces

Search Logs

Manage Rootprint

Built-in OpenTelemetry index

Schema

Core fields

Attributes

Trace context

Instrumentation scope

Example payload

Custom indexes

Next steps

​Built-in OpenTelemetry index

​Schema

​Core fields

​Attributes

​Trace context

​Instrumentation scope

​Example payload

​Custom indexes

​Next steps

Built-in OpenTelemetry index

Schema

Core fields

Attributes

Trace context

Instrumentation scope

Example payload

Custom indexes

Next steps