Log management and analytics

This field is mandatory for all log records. Use an absolute file path for file-based ingest, an S3 URI for S3-sourced data, an HTTPS URL for API-based ingest, and the format documented by the ingest mechanism for other sources. Collectors may normalize the value to a canonical form, for example, by stripping rotation suffixes so that auth.log.1 and auth.log map to the same source, or by removing non-deterministic suffixes that change across stream rotations. AWS CloudWatch Logs appends a hash to EKS audit log stream names, producing names like kube-apiserver-audit-abc123def456abc123def456abc123def456; because that hash changes each time the stream rotates, strip it and record only the stable prefix kube-apiserver-audit. For syslog and other network-based ingest, use the most specific origin available. If the sender preserved a file path in the message, use that. If not, use the identifier the collector assigns to the listener.

The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.

Requires log.type to be set. Only set when the serialization format is not already implied by log.type. For example, log.type 'w3c' is always space-delimited plaintext by definition, so log.encoding adds nothing and should be omitted. By contrast, log.type 'kube-audit' does not mandate an encoding, so log.encoding = 'json' adds genuine information. Describes how the log body is encoded at the byte or text level, independently of the message format standard in log.format. JSON and JSONL are distinct values: JSON represents a single complete document, while JSONL (also called NDJSON or JSON Lines) places one JSON object per line and requires line-by-line parsing. This field describes the content-level serialization of the log body, not the ingestion protocol or wire format used to deliver the record to Dynatrace (see dt.ingest.format), and not character encoding such as UTF-8.

Requires log.type to be set. Only use when a type-agnostic container format is in use and log.type alone does not describe the structure. Identifies a named structural convention that can carry different types of events from different products without implying what the content is. CEF and LEEF are the canonical examples: a firewall and an IDS can both emit CEF carrying entirely different field vocabularies, so log.type is still needed to identify the content. Web log conventions such as clf, ncsa-combined, and w3c are excluded because they imply a content type (web server access log) and belong in log.type instead. Use log.encoding for the serialization format of the payload (for example, JSON or XML).

This field is mandatory for all log records. Use an absolute file path for file-based ingest, an S3 URI for S3-sourced data, an HTTPS URL for API-based ingest, and the format documented by the ingest mechanism for other sources. Collectors may normalize the value to a canonical form, for example, by stripping rotation suffixes so that auth.log.1 and auth.log map to the same source, or by removing non-deterministic suffixes that change across stream rotations. AWS CloudWatch Logs appends a hash to EKS audit log stream names, producing names like kube-apiserver-audit-abc123def456abc123def456abc123def456; because that hash changes each time the stream rotates, strip it and record only the stable prefix kube-apiserver-audit. For syslog and other network-based ingest, use the most specific origin available. If the sender preserved a file path in the message, use that. If not, use the identifier the collector assigns to the listener.

This field is mandatory. It is the primary classification field: if log.type fully describes the record, no further fields are needed. Add log.format only when a type-agnostic container format is in use and the type alone does not describe the structure. Add log.encoding only when the serialization is not implied by log.type (for example, log.type 'w3c' is always plaintext; setting log.encoding would be redundant). Values should be lowercase and describe the log's meaning rather than its origin technology or vendor. For example, use 'kube-audit' for Kubernetes audit logs regardless of whether they originate from EKS, GKE, AKS, or an on-prem cluster. No fixed taxonomy is enforced. Use only lowercase letters, digits, and hyphens in values. Dots, colons, and underscores are not allowed. This prevents structured separators from encoding vendor and datasource together (for example, 'aws:cloudtrail'), which is the job of product.vendor and product.name.