What is the bug?

tl;dr, reserved keywords cause PPL search issues & UI bugs when a field is of these names.

I have various fields, which I can utilise in DQL searches. However, in Observability (I'm working in Event Analytics section), the fields display in UI, but the values for these are not populated, and when querying with PPL there are errors.

I have tested this on OS 2.4.1, which is my install. I tried the latest in the playground, but that wasn't working well for me at all.
The sample commerce data has a field named type so this is a good one to use for testing.

The bugs are not present in my 1.3.8 install.

There is a workaround for PPL, which is that field names which are reserved keywords need to be backticked. If I use quotes there isn't an error, but there aren't any results either.

For the UI, there's some bug which needs addressing.

Reserved keywords are not documented anywhere that I can see. I know type and ip. What are others?

Needing to use backticks for some field names is not documented. I feel like this is a workaround rather than a fix.

Error messages are not very helpful. Could be more accurate as to the specific issue.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Go to Event Analytics
2. Search a source where the index has a field of the same name as a restricted keyword.
   3 Observe no values populated for the field
   4 Add a search such as | where type = "value"
   5 Observe error.

What is the expected behavior?
UI to populate field values.
PPL to not need backticks, or for this to be documented.
Documentation coverage.

What is your host/environment?

• OS: Fedora. Also tried via docker-compose.
• Version 2.4.1
• Plugins: Just stock plugins.

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?

As discussed with @anirudha & others from the team.

There is a previous Issue raised for this with a field named ip opensearch-project/observability#1148
IMHO it was closed with too little information, due to restricted fields not being documented and the unhelpful error messages.