Ingest OpenTelemetry logs

When ingesting OpenTelemetry logs, the following transformation rules and ingestion limitations apply.

Data types

Dynatrace supports OpenTelemetry's default Any data type for data ingestion, with Any being any of these values:

  • Scalar values (strings, numbers, Booleans)
  • Arrays of Any
  • Byte arrays
  • Maps with string keys and Any values

Scalar value

Scalar values are ingested in their string representation.

Type
Data
Ingested as
String
"hello world"
"hello world"
Number
1234
"1234"
Boolean
false
"false"

Byte array

A byte array is ingested as Base64-encoded string. For example, the following array

[0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64]

is transformed and ingested as aGVsbG8gd29yZA==.

Array

An array of Any is ingested as such, but with each value transformed as follows:

  • Scalar values are ingested in their string representation (see scalar value)
  • Byte arrays are ingested as Base64 strings (see byte array)
  • Any arrays and maps are ingested as JSON-serialized strings (up to five levels)

Map

Maps are ingested by extracting their keys recursively and storing the values as separate attributes, with names reflecting their position in the map hierarchy and prefixed with the map name.

For example, this attribute map planet:

{
"name": "earth"
"system" : {
"name": "solar",
"galaxy": {
"name": "milky way",
"group": {
"name": "local"
}
}
}
}

would be flattened into four attributes:

"planet.name": "earth"
"planet.system.name": "solar"
"planet.system.galaxy.name": "milky way"
"planet.system.galaxy.group.name": "local"
  • Scalar values are ingested in their string representation (see scalar value)
  • Byte arrays are ingested as Base64 strings (see byte array)
  • Any arrays are ingested as lists, with values being transformed as arrays
  • Maps are flattened as outlined above (up to five levels)

Semantic attributes

A number of attribute names are automatically recognized by Dynatrace and mapped to the respective Dynatrace log fields.

For example, if you provide an attribute Timestamp, its value is automatically parsed as the date and time for that log record.

For a full list of attributes and their names, see "Supported semantic attribute keys" at Log Monitoring API - POST ingest logs.

Attribute ingestion

OpenTelemetry supports attributes on different levels in an OpenTelemetry log request, such as resource attributes, scope attributes, and record attributes.

Because attributes are saved in a flattened fashion on the Dynatrace side, there may be name collisions if attributes on different levels share the same name. Dynatrace resolves this by prefixing duplicate attributes with overwritten[COUNTER].. The counter value indicates how many times the attribute name has been already encountered as a duplicate.

For example, if you have three attributes all named my.attribute on the resource, scope, and log levels:

  • the resource attribute is ingested as my.attribute
  • the scope attribute is ingested as overwritten1.my.attribute
  • the log attribute is ingested as overwritten2.my.attribute

Ingestion limits

The following limitations apply to ingested OpenTelemetry log requests and their attributes and values.

Type
Limit
Description
Log age
24 hours
The maximum age of log entries when ingested
Logs with future dates
No restriction, but see footnote1
How far into the future log entries can reach
Attribute count
50 attributes
The maximum number of attributes a log can contain
Values per attribute
32 values
The maximum number of individual values an attribute can contain
Attribute length
250 bytes
The maximum length of an attribute value
Body size
64 KB for Grail, 8 KB for Classic
The maximum size of log entry body (content)
Request size
2 MB
The maximum size of an OTLP request
Number of log records
50,000 records
The maximum number of log records per OTLP request
Nested objects
5 levels
The maximum number of levels ingested with nested objects (arrays and maps)
1

There is no ingestion limitation on log entries with future timestamps, but entries with timestamps further than 10 minutes into the future have their timestamps set to the moment of ingestion.

Log metrics

The following Dynatrace-specific metrics can be useful when analyzing log ingestion issues.

Name
Description
dsfm:active_gate.event_ingest.event_incoming_count
Number of ingested log records
dsfm:active_gate.event_ingest.drop_count
Number of dropped log records
dsfm:active_gate.event_ingest.event_otlp_size
Payload size of received log requests