Afterthought: I would settle for the non-painfully-obvious ones. `collection` was the one that prompted this question.

Should be listed on sources and destinations in the docs for those that are supported/generated: https://docs.cribl.io/stream/sources-syslog#internal-fields

`collection` is an odd one because it's specific to the collector sources and varies between each collector type.

Hm. I will certainly now keep an eye out for that section as I'm sure those internal fields will come in handy.However, I only see the field, `__inputId` for example, but not what to expect for the value in these cases.

those identifiers are most for internal use to map schema/config on disk to the backing class that does the processing, and hence subject to change, but a current list for sources/destinations looks something like```Outputs:'default''router''tcpjson''splunk''splunk_lb''splunk_hec''syslog''filesystem''s3''azure_blob''azure_logs''kafka''confluent_cloud''kinesis''elastic''honeycomb''newrelic''newrelic_events''snmp''influxdb''minio''devnull''cloudwatch''azure_eventhub''statsd''statsd_ext''graphite''wavefront''signalfx''sqs''google_cloud_storage''sumo_logic''datadog''webhook''prometheus''google_pubsub''google_chronicle''grafana_cloud''loki''open_telemetry''dataset''ring''humio_hec''cribl_http''cribl_tcp''google_cloud_logging'Inputs:'splunk''splunk_hec''syslog''tcpjson''grafana''loki''http''http_raw''firehose''elastic''kafka''confluent_cloud''kinesis''eventhub''azure_blob''metrics''sqs''s3''snmp''crowdstrike''tcp''office365_service''office365_mgmt''office365_msg_trace''prometheus''prometheus_rw''appscope''google_pubsub''open_telemetry''datadog_agent''wef''datagen''cribl''criblmetrics''cribl_http''cribl_tcp''win_event_logs''system_metrics''windows_metrics''system_state''kube_metrics''kube_logs''exec''splunk_search''file'```As you said, mostly self-explanatory other than `collection`, but there it is

Excellent, <@U02AML9NL2C&gt;! Thank you!