Ingest OTLP logs

Reference
3-min read

When ingesting OpenTelemetry logs, the following transformation rules and ingestion limitations apply.

Data types

Dynatrace supports OpenTelemetry data types as described in the sections below.

Scalar value

Scalar values are transformed as such:

Logs on Grail with OpenPipeline custom processing (Dynatrace SaaS version 1.295+, Environment ActiveGate version 1.295+): All JSON data types (string, number, boolean, null) are supported. All attributes can be used in queries. Keys are case-sensitive.
Logs on Grail with OpenPipeline routed to Classic Pipeline: All attribute keys are lowercased and all attribute values are stringified. All attributes can be used in queries.
Log Monitoring Classic: All attribute keys are lowercased and all attribute values are stringified. Custom attributes and semantic attributes can generally be used in queries.

Byte array

Byte arrays are converted to base64-encoded strings. For example, the following array

[0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64]

is transformed and ingested as aGVsbG8gd29yZA==.

Array

Array attribute values are converted to arrays of a uniform type. The target type is chosen according to the following rules:

Complex values, such as arrays, or objects are mapped to JSON string values.
If any value in the array is a string, or if any value must be converted to a string (e.g., an object or array), the target type of the entire array is string.
If all values in the source array are numeric, the target array type is numeric.
Null values are considered compatible with any type.

Map

Maps are ingested by extracting their keys recursively and storing the values as separate attributes, with names reflecting their position in the map hierarchy and prefixed with the map name.

For example, this attribute map planet:

{
  "name": "earth"
  "system" : {
    "name": "solar",
    "galaxy": {
      "name": "milky way",
      "group": {
        "name": "local"
      }
    }
  }
}

would be flattened into four attributes:

"planet.name": "earth"
"planet.system.name": "solar"
"planet.system.galaxy.name": "milky way"
"planet.system.galaxy.group.name": "local"

Scalar values are ingested in their string representation (see scalar value)
Byte arrays are ingested as Base64 strings (see byte array)
Any arrays are ingested as lists, with values being transformed as arrays
Maps are flattened as outlined above (up to five levels)

Semantic attributes

A number of attribute names are automatically recognized by Dynatrace and mapped to the respective Dynatrace log fields.

For example, if you provide an attribute Timestamp, its value is automatically parsed as the date and time for that log record.

For a full list of attributes and their names, see "Supported semantic attribute keys" at Log Monitoring API v2 - POST ingest logs.

Attribute ingestion

OpenTelemetry supports attributes at different levels in an OpenTelemetry log request, such as the resource level, scope level, and record level.