This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Parse OpenTelemetry messages

By default, AxoSyslog doesn’t parse the fields of incoming OpenTelemetry messages into name-value pairs, but are only available for forwarding using the opentelemetry() destination. To parse the fields into name-value pairs, use the opentelemetry() parser.

The opentelemetry() parser parses the fields into name-value pairs starting with the .otel. prefix.

  • The type of the message is stored in the .otel.type field (possible values: log, metric, and span).
  • Resource information is mapped into the .otel.resource.<...> , for example, .otel.resource.dropped_attributes_count, or .otel.resource.schema_url.
  • Scope information is mapped into .otel.scope.<...>, for example, .otel.scope.name, .otel.scope.schema_url.
  • The fields of log records are mapped into .otel.log.<...>, for example, .otel.log.body, .otel.log.severity_text.
  • The fields of metrics are mapped into .otel.metric.<...>, for example, .otel.metric.name, .otel.metric.unit.
    • The type of the metric is mapped into .otel.metric.data.type. Possible values: gauge, sum, histogram, exponential_histogram, summary.
    • The actual data is mapped into .otel.metric.data.<type>.<...>, for example, .otel.metric.data.gauge.data_points.0.time_unix_nano.
  • The fields of traces are mapped into .otel.span.<...>, for example, .otel.span.name, .otel.span.trace_state. Repeated fields have an index, for example, .otel.span.events.5.time_unix_nano.

For details on the parsed fields, you can check the OpenTelemetry proto files.

See also the related Handle OpenTelemetry log records functions. They map the message into typed OTEL objects instead of flattening it into .otel. name-value pairs.

Mapping data types

String, bool, int64, double, and bytes values are mapped to their respective AxoSyslog name-value type, for example, .otel.resource.attributes.string_key becomes a string value.

The mapping of AnyValue type fields is limited.

ArrayValue and KeyValueList types are stored serialized with protobuf type. Note that protobuf and bytes types are only available, unless explicitly type cast. For example, bytes(${.otel.log.span_id}). When using template functions, use --include-bytes, for example, $(format-json .otel.* --include-bytes. In the case of $(format-json), the content is base64-encoded into the bytes content.

Options

The opentelemetry() parser has the following options.

internal()
Accepted values: yes, no
Default: no

Description: Marks this pipeline element as internal. Elements marked as internal() are treated as an implementation detail, so for example statistics of the given pipe are available only on higher stats level. This option is mainly useful for developers or when writing SCL blocks and integrations.

set-hostname()
Synopsis: yes or no
Default: yes

Available in AxoSyslog 4.8 and later.

Description: If set to yes, the parser extracts the host.name resource attribute if available in the message. Otherwise, it leaves the HOST field as-is.

<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

template()
Synopsis: template("${<macroname>}")

Description: The macro that contains the part of the message that the parser will process. It can also be a macro created by a previous parser of the log path. By default, the parser processes the entire message (${MESSAGE}).