Ingest OpenTelemetry logs
When ingesting OpenTelemetry logs, the following transformation rules and ingestion limitations apply.
Data types
Dynatrace supports OpenTelemetry's default Any
data type for data ingestion, with Any
being any of these values:
- Scalar values (strings, numbers, Booleans)
- Arrays of
Any
- Byte arrays
- Maps with string keys and
Any
values
Scalar value
Scalar values are ingested in their string representation.
Byte array
A byte array is ingested as Base64-encoded string. For example, the following array
[0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64]
is transformed and ingested as aGVsbG8gd29yZA==
.
Array
An array of Any
is ingested as such, but with each value transformed as follows:
- Scalar values are ingested in their string representation (see scalar value)
- Byte arrays are ingested as Base64 strings (see byte array)
Any
arrays and maps are ingested as JSON-serialized strings (up to five levels)
Map
Maps are ingested by extracting their keys recursively and storing the values as separate attributes, with names reflecting their position in the map hierarchy and prefixed with the map name.
For example, this attribute map planet
:
{"name": "earth""system" : {"name": "solar","galaxy": {"name": "milky way","group": {"name": "local"}}}}
would be flattened into four attributes:
"planet.name": "earth""planet.system.name": "solar""planet.system.galaxy.name": "milky way""planet.system.galaxy.group.name": "local"
- Scalar values are ingested in their string representation (see scalar value)
- Byte arrays are ingested as Base64 strings (see byte array)
Any
arrays are ingested as lists, with values being transformed as arrays- Maps are flattened as outlined above (up to five levels)
Semantic attributes
A number of attribute names are automatically recognized by Dynatrace and mapped to the respective Dynatrace log fields.
For example, if you provide an attribute Timestamp
, its value is automatically parsed as the date and time for that log record.
For a full list of attributes and their names, see "Supported semantic attribute keys" at Log Monitoring API - POST ingest logs.
Attribute ingestion
OpenTelemetry supports attributes on different levels in an OpenTelemetry log request, such as resource attributes, scope attributes, and record attributes.
Because attributes are saved in a flattened fashion on the Dynatrace side, there may be name collisions if attributes on different levels share the same name. Dynatrace resolves this by prefixing duplicate attributes with overwritten[COUNTER].
. The counter value indicates how many times the attribute name has been already encountered as a duplicate.
For example, if you have three attributes all named my.attribute
on the resource, scope, and log levels:
- the resource attribute is ingested as
my.attribute
- the scope attribute is ingested as
overwritten1.my.attribute
- the log attribute is ingested as
overwritten2.my.attribute
Ingestion limits
The following limitations apply to ingested OpenTelemetry log requests and their attributes and values.
There is no ingestion limitation on log entries with future timestamps, but entries with timestamps further than 10 minutes into the future have their timestamps set to the moment of ingestion.
Log metrics
The following Dynatrace-specific metrics can be useful when analyzing log ingestion issues.
dsfm:active_gate.event_ingest.event_incoming_count
dsfm:active_gate.event_ingest.drop_count
dsfm:active_gate.event_ingest.event_otlp_size