Ingest OTLP logs

• Reference
• 3-min read
• Published Apr 28, 2023

When ingesting OpenTelemetry logs, the following transformation rules and ingestion limitations apply.

Data types

Dynatrace supports OpenTelemetry's default Any data type for data ingestion, with Any being any of these values:

Scalar value

Scalar values are ingested in their string representation.

Byte array

A byte array is ingested as Base64-encoded string. For example, the following array

[0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64]

is transformed and ingested as aGVsbG8gd29yZA==.

Array

An array of Any is ingested as such, but with each value transformed as follows:

Map

Maps are ingested by extracting their keys recursively and storing the values as separate attributes, with names reflecting their position in the map hierarchy and prefixed with the map name.

For example, this attribute map planet:

{
  "name": "earth"
  "system" : {
    "name": "solar",
    "galaxy": {
      "name": "milky way",
      "group": {
        "name": "local"
      }
    }
  }
}

would be flattened into four attributes:

"planet.name": "earth"
"planet.system.name": "solar"
"planet.system.galaxy.name": "milky way"
"planet.system.galaxy.group.name": "local"

Semantic attributes

A number of attribute names are automatically recognized by Dynatrace and mapped to the respective Dynatrace log fields.

For example, if you provide an attribute Timestamp, its value is automatically parsed as the date and time for that log record.

For a full list of attributes and their names, see "Supported semantic attribute keys" at Log Monitoring API - POST ingest logs.

Attribute ingestion

OpenTelemetry supports attributes on different levels in an OpenTelemetry log request, such as resource attributes, scope attributes, and record attributes.

Because attributes are saved in a flattened fashion on the Dynatrace side, there may be name collisions if attributes on different levels share the same name. Dynatrace resolves this by prefixing duplicate attributes with overwritten[COUNTER].. The counter value indicates how many times the attribute name has been already encountered as a duplicate.

For example, if you have three attributes all named my.attribute on the resource, scope, and log levels:

Ingestion limits

See Log Management and Analytics default limits and Log Monitoring default limits (Logs Classic) for the limits applied to ingested log requests, their attributes and values.