Go big with Dynatrace: Native support for large log records

From aircraft telemetry and passenger handling to trading trails, modern IT ecosystems produce massive single-log-event records that legacy tools can’t handle. Dynatrace supports your large log event use cases natively, with zero configuration and zero compromise.

Dynatrace has redefined what’s possible in log analytics with support for single log events up to 10 MB, setting a new standard in log observability. This eliminates manual workarounds and allows full-fidelity log ingestion at enterprise scale for customers moving their log management and analytics to Dynatrace.

In this blog post, we will examine specific customer examples from different verticals across aviation, retail, cargo, and beyond and examine how they’ve increased the simplicity and reliability of their use cases using Dynatrace.

Large log records are business-critical

While not all businesses generate large log records, those that do consider them operational gold, containing tremendous additional value that can be unlocked. In industries like cargo and transportation, healthcare, or autonomous vehicles, individual events and resulting log records can range in size from a few hundred kilobytes to several megabytes. These records carry essential diagnostic signals, event telemetry, and traces to address compliance requirements.

Yet many traditional log management vendors struggle with records larger than a few MB or require additional manual scaling configuration, scripting skills, or custom tooling upgrades to support enhanced ingestion or increased record retention limits.

With Dynatrace, it’s zero-config and effortless: You can ingest single log records natively up to 10 MB, ensuring full context and accurate analysis. You can take immediate action without trimming, truncation, or fear of ingest failures caused by custom scripts.

Real-world use cases: Built for enterprise workloads at scale

Use case #1: European airline group – Passenger-handling log trails

The aviation industry shares a standard for passenger handling and boarding trails, such as Passenger Name Records (PNR). In some systems, such events, which are crucial to daily operations, can appear as single large log entries and can easily reach sizes larger than 3 MB. In addition, they hold business observability telemetry, which can offer unconsidered value you can unlock using Dynatrace Business Observability.

Previously, our aviation customer used the ELK stack, which required custom tools to ingest and correlate these logs, due to the limitation of 3 MB log event support.

With Dynatrace, logs are ingested seamlessly through OneAgent® and OpenTelemetry (OTel) with no difference in outcome. This way, you can easily scale up and scale out at any time. No pre-/post-processing of large log events is required, and events are available across many Dynatrace® Apps and use cases within the Dynatrace platform.

This tremendously accelerates forensics, reduces operational overhead, and improves business observability or compliance reviews.

Mastering logs with Dynatrace: Unlock log insights without queries (12 min video)

Use case #2: Leading European telecom provider

For telecom providers, retail sales of mobile phones are tied to even more metadata, while business processes are linked to SLA fulfillment. When customers order a mobile phone, the whole lifecycle of delivery, contract activation, SIM card assignment, and unlocking occurs in the provider network.

In this European telecom provider’s previous solution, ingestion failed unless XML tracing log events were split, as the trail event size could easily be larger than 5 MB. Faced with log ingest limits, splitting logs was the only option, resulting in disconnected events and increased manual correlation efforts.

With Dynatrace, full payloads are ingested and visualized with automatic JSON structure recognition and parsing. This allows precise and simple yet powerful filtering in the GUI, with the Dynatrace Query Language (DQL), and Dynatrace Apps, such as Dashboards, Workflow automation, and more.

Download our free eBook to learn how Dynatrace helps its retail customers.

Use case #3: National rail operator

Previously, our customer had to tail and process log event records from their signaling systems using shell scripts. Also, their legacy monitoring system ingested monitoring events into a SQL database, from which our customer had to tail/parse the recent log records. Creating correlation and context between these wasn’t easy.

With Dynatrace, our customer now leverages OneAgent to automatically collect all log records, signals, and metrics. With OneAgent observing their SQL server, they have entered the next level of database observability.

This provides them with the capability to extract events directly from the SQL database, centrally configured on the Dynatrace platform, using the simple yet powerful Dynatrace custom extension creator. If your requirements are more complex than these, a custom extension based on the Dynatrace SQL extension, as shown in the video linked below, will help you address your use cases.

A Practical Guide to SQL Extensions with Dynatrace (53 min video)

Engineers now see full context and experience true observability, without relying on or maintaining fragile ingest logic in custom bash scripts.

Use case #4: Software engineering giant

Our customer faced persistent data loss due to truncation with their previous tool, which occasionally resulted in inconsistent formatting and missing fields. Therefore, they were blocked from accessing certain events, metrics, and meaningful analysis.

With Dynatrace, large JSON log records are parsed as a single record and presented as full events. In addition, our customer can extract metrics and fields from logs during ingestion, and even drop irrelevant records after extraction.

The Dynatrace platform and its apps provide structured views, allowing developers to inspect, filter, and find data in any field/column using the app-specific filter options or performing deep search data exploration.

Dynatrace provides SREs with live forecasting and baselining capabilities that don’t rely on predefined metrics but can use any raw data, such as historic logs, in case an ad-hoc request arises. This is quite common in software engineering when debugging new code or identifying new conditions for setting up alerts or remediation workflows.

Unmatched experience with the Logs app

The Dynatrace Logs app makes working with large, complex logs easier than ever:

• Visual JSON parsing renders nested data in structured, searchable log row results and single events.
• Click-to-filter exploration allows real-time root cause discovery with filter-in and filter-out features.
• Filter → DQL conversion turns applied log filters into Dynatrace Query Language—a true unified and platform-wide query language that addresses your needs and can be used for alerts, dashboards, and automation.

Filters with segments allow you and your teams to predefine reusable views that dynamically filter results by region, cluster, or other dynamic values relevant to your business—cut down search times and promote consistency across departments and your entire organization.

From triage to transformation

These capabilities radically simplify life for site reliability engineers:

• ✅ No more log truncation or splitting
• ✅ No more ingest failure troubleshooting
• ✅ No more duct-taped parsing and log correlation

Instead, SREs get full-fidelity, contextual AI assistance and a unified platform experience across logs, metrics, and traces—all within a single platform.

Ready to go big?

Stop fighting your log tools and start scaling with Dynatrace today:

• Start your free trial and ingest your logs using OneAgent, API, OTLP, Cribl, Fluent, Syslog, Journald, or any other method you choose.
• Alternatively, request a live demo for a tailored walkthrough.

___

© 2025 Dynatrace LLC

Dynatrace and the Dynatrace logo, are trademarks of the Dynatrace, Inc. group of companies. All other trademarks are the property of their respective owners.