Ingest OpenTelemetry logs

When ingesting OpenTelemetry logs, the following transformation rules and ingestion limitations apply.

Data types

Dynatrace supports OpenTelemetry's default Any data type for data ingestion, with Any being any of these values:

• Scalar values (strings, numbers, Booleans)
• Arrays of Any
• Byte arrays
• Maps with string keys and Any values

Scalar value

Scalar values are ingested in their string representation.

Byte array

A byte array is ingested as Base64-encoded string. For example, the following array

plaintextcopydownload
[0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64]

is transformed and ingested as aGVsbG8gd29yZA==.

Array

An array of Any is ingested as such, but with each value transformed as follows:

• Scalar values are ingested in their string representation (see scalar value)
• Byte arrays are ingested as Base64 strings (see byte array)
• Any arrays and maps are ingested as JSON-serialized strings (up to five levels)

Map

Maps are ingested by extracting their keys recursively and storing the values as separate attributes, with names reflecting their position in the map hierarchy and prefixed with the map name.

For example, this attribute map planet:

jsoncopydownload
{
  "name": "earth"
  "system" : {
    "name": "solar",
    "galaxy": {
      "name": "milky way",
      "group": {
        "name": "local"
      }
    }
  }
}

would be flattened into four attributes:

plaintextcopydownload
"planet.name": "earth"
"planet.system.name": "solar"
"planet.system.galaxy.name": "milky way"
"planet.system.galaxy.group.name": "local"

• Scalar values are ingested in their string representation (see scalar value)
• Byte arrays are ingested as Base64 strings (see byte array)
• Any arrays are ingested as lists, with values being transformed as arrays
• Maps are flattened as outlined above (up to five levels)

Semantic attributes

A number of attribute names are automatically recognized by Dynatrace and mapped to the respective Dynatrace log fields.

For example, if you provide an attribute Timestamp, its value is automatically parsed as the date and time for that log record.

For a full list of attributes and their names, see "Supported semantic attribute keys" at Log Monitoring API - POST ingest logs.

Attribute ingestion

OpenTelemetry supports attributes on different levels in an OpenTelemetry log request, such as resource attributes, scope attributes, and record attributes.

Because attributes are saved in a flattened fashion on the Dyntrace side, there may be name collisions if attributes on different levels share the same name. Dynatrace resolves this by prefixing duplicate attributes with overwritten[COUNTER].. The counter value indicates how many times the attribute name has been already encountered as a duplicate.

For example, if you have three attributes all named my.attribute on the resource, scope, and log levels:

• the resource attribute is ingested as my.attribute
• the scope attribute is ingested as overwritten1.my.attribute
• the log attribute is ingested as overwritten2.my.attribute

Ingestion limits

The following limitations apply to ingested OpenTelemetry log requests and their attributes and values.

Log metrics

The following Dynatrace-specific metrics can be useful when analyzing log ingestion issues.