Log content transformation

Dynatrace enables you to transform logs ingested both via OneAgent and API.

Transform API-ingested logs

Generic log ingestion automatically transforms status, severity, level, and syslog.severity severity keys to the loglevel attribute.

The input values for the status, severity, level, and syslog.severity severity keys are transformed (transformation is not case sensitive) into output values for the loglevel attribute based on the following mapping:

Input value	Output value	Example value
Begins with `emerg` or `f`	`EMERGENCY`	`Emergency`, `fail`, `Failure`
Begins with `e` excluding `emerg`	`ERROR`	`Error`, `error`
Begins with `a`	`ALERT`	`alarm`, `Alert`
Begins with `c`	`CRITICAL`	`Critical`, `crucial`
Begins with `s`	`SEVERE`	`Severe`, `serious`
Begins with `w`	`WARN`	`warn`, `Warning`
Begins with `n`	`NOTICE`	`note`, `Notice`
Begins with `i`	`INFO`	`Info`, `information`
Begins with `d` or `trace` or `verbose`	`DEBUG`	`debug`, `TRACE`, `Verbose`

Transform the OneAgent-ingested logs

During log ingest via OneAgent, the severity of logs is determined.

Log severity

By default, the log event severity is detected through a keyword search performed on the first 100 characters of the log content, within the first two lines of text.

To adjust these limits

In the Dynatrace menu, go to Settings.
Select Log Monitoring > OneAgent settings.
Adjust the following settings as needed.
- Severity search chars limit is the number of characters in each log line, starting from the first character, to search for severity.
- Severity search lines limit is the number lines in each log entry, starting from the first line, to search for severity.

There are 19 keywords that correspond with 9 severity levels as per the table below:

Keyword	Severity level
["trace"]	SEVERITY_LEVEL__DEBUG
["debug"]	SEVERITY_LEVEL__DEBUG
["fine"]	SEVERITY_LEVEL__DEBUG
["finer"]	SEVERITY_LEVEL__DEBUG
["finest"]	SEVERITY_LEVEL__DEBUG
["notice"]	SEVERITY_LEVEL__NOTICE
["info"]	SEVERITY_LEVEL__INFO
["information"]	SEVERITY_LEVEL__INFO
["warn"]	SEVERITY_LEVEL__WARN
["warning"]	SEVERITY_LEVEL__WARN
["severe_warning"]	SEVERITY_LEVEL__WARN
["severe"]	SEVERITY_LEVEL__SEVERE
["err"]	SEVERITY_LEVEL__ERROR
["error"]	SEVERITY_LEVEL__ERROR
["crit"]	SEVERITY_LEVEL__CRITICAL
["critical"]	SEVERITY_LEVEL__CRITICAL
["alert"]	SEVERITY_LEVEL__ALERT
["fatal"]	SEVERITY_LEVEL__EMERGENCY
["emerg"]	SEVERITY_LEVEL__EMERGENCY

A match occurs and severity is determined when

The keyword found is a single word/phrase from the above list, and it is preceded and followed by a space.
The keyword found is a single word/phrase from the above list, and it is preceded and followed by one of the four predefined non-alphanumeric symbols, as in the example below:

[error]
{error}
{{error}}
<error>

Transform all types of logs

Additionally, for each log event, a status attribute is created with a value that is a sum of loglevel values based on the following grouping:

Included `loglevel` values	Combined `status` attribute value
`SEVERE`, `ERROR`, `CRITICAL`, `ALERT`, `FATAL`, `EMERGENCY`	`ERROR`
`WARN`	`WARN`
`INFO`, `TRACE`, `DEBUG`, `NOTICE`	`INFO`
`NONE`	`NONE`

For example: The level severity key in the generic log ingestion API request parameter contains the value serious.

The level severity key is transformed into the loglevel attribute with the serious value mapped to SEVERE based on the above table.
The loglevel attribute containing the SEVERE value is grouped into status attribute. Based on the grouping table above, the status attribute will contain the ERROR value.
For the log event details, the log viewer will report the following:

status - ERROR
loglevel - SEVERE

Attributes added during a log ingest via OneAgent

During the log ingestion via OneAgent, the following attributes are added automatically:

General attributes (via OneAgent)

container.name
container.image.name
container.id
dt.host_group.id
dt.kubernetes.cluster.id
dt.kubernetes.cluster.name
dt.kubernetes.node.system_uuid
dt.process.name
event.type
host.name
k8s.cluster.name
k8s.namespace.name
k8s.pod.name
k8s.pod.uid
k8s.container.name
k8s.deployment.name
log.iostream
loglevel
log.source
process.technology
span_id
status
trace_id
web_server.iis.site_id
web_server.iis.site_name
web_server.iis.application_pool

dt entity model attributes (via OneAgent)

dt.entity.cloud_application
dt.entity.cloud_application_instance
dt.entity.cloud_application_namespace
dt.entity.container_group
dt.entity.container_group_instance
dt.entity.host
dt.entity.kubernetes_cluster
dt.entity.kubernetes_node
dt.entity.process_group
dt.entity.process_group_instance
dt.source_entity