Preconditions

Dash0 only scans a log record for nested JSON payloads if certain preconditions are met:

The log record does not have a severity number or severity text yet.
The log record body is either a string (which contains the JSON payload) or a map.
If the log record body is a string it must contain a valid JSON document (starting with { and ending with }).
The nested structured payload contains a severity field (see Log Level).

If Dash0 processed nested structured data within a log record, it will add a log record attribute named dash0.log.processor.type with the value json.

Message

The following keys are mapped to the log record body (first match wins):

@m
msg
message
log
output
MESSAGE

Log Level

The following keys are mapped to the log record severity number (first match wins):

log.level
level
s
priority
@l
_logLevel

Severity Mapping

The severity in the previously listed fields is mapped to the log record severity number as follows:

Trace

Value	Severity Number
`finest`	1 (Trace)
`t`	1 (Trace)
`trace`	1 (Trace)
`loglevel.trace`	1 (Trace)

Debug

Value	Severity Number
`v`	5 (Debug)
`verbose`	5 (Debug)
`d`	5 (Debug)
`d1`	5 (Debug)
`d2`	6 (Debug2)
`d3`	7 (Debug3)
`d4`	8 (Debug4)
`d5`	8 (Debug4)
`dbg`	5 (Debug)
`debug`	5 (Debug)
`finer`	5 (Debug)
`fine`	6 (Debug2)
`config`	7 (Debug3)
`loglevel.debug`	5 (Debug)

Info

Value	Severity Number
`i`	9 (Info)
`inf`	9 (Info)
`info`	9 (Info)
`information`	9 (Info)
`informational`	9 (Info)
`loglevel.information`	9 (Info)
`notice`	10 (Info2)

Warn

Value	Severity Number
`w`	13 (Warn)
`wrn`	13 (Warn)
`warn`	13 (Warn)
`warning`	13 (Warn)
`loglevel.warning`	13 (Warn)

Error

Value	Severity Number
`e`	17 (Error)
`err`	17 (Error)
`error`	17 (Error)
`severe`	17 (Error)
`loglevel.error`	17 (Error)
`critical`	18 (Error2)
`dpanic`	18 (Error2)
`alert`	19 (Error3)
`panic`	19 (Error3)

Fatal

Value	Severity Number
`f`	21 (Fatal)
`fatal`	21 (Fatal)
`emergency`	21 (Fatal)
`loglevel.critical`	21 (Fatal)

Service Name

The following keys are mapped to the service.name attribute (first match wins):

service_name
serviceName
otelServiceName

Timestamp

The following keys are mapped to the log record time (first match wins):

@timestamp
timestamp
@t
time
ts
date_time

Trace ID

The following keys are mapped to the Trace ID (first match wins):

trace_id
trace.id
traceId
@tr
otelTraceID

Note: Only hex-encoded strings with exactly 16 bytes (32 hex characters) are eligible as Trace ID.

Span ID

The following keys are mapped to the Span ID (first match wins):

span_id
span.id
spanId
@sp
otelSpanID

Note: Only hex-encoded strings with exactly 8 bytes (16 hex characters) are eligible as Span ID.

Trace Sampling

If the otelTraceSampled key exists and has a boolean value, it will be used to set the trace flag SAMPLED accordingly.

journald (systemd)

If a journal entry is detected (includes a key named __CURSOR), the following keys are mapped to their corresponding log record attribute according to the OpenTelemetry Semantic Conventions:

Key	OpenTelemetry Attribute
`_HOSTNAME`	`host.name`
`_MACHINE_ID`	`host.id`
`_PID`	`process.pid`
`_COMM`	`process.executable.name`
`_EXE`	`process.executable.path`
`_CMD`	`process.command`
`_CMDLINE`	`process.command_line`
`_UID`	`process.owner`
`_TRANSPORT`	`log.iostream`
`_SYSTEMD_CGROUP`	`process.linux.cgroup`

Additionally, the _SOURCE_REALTIME_TIMESTAMP key is mapped to the log record timestamp if it exists and has an integer number as value.

journald Severity Mapping

The priority in the PRIORITY field of a journal entry is mapped to log record severity number as follows:

Priority	Severity Number	Description
0	24 (Fatal4)	Emergency: system is unusable
1	21 (Fatal)	Alert: action must be taken immediately
2	18 (Error2)	Critical: critical conditions
3	17 (Error)	Error: error conditions
4	13 (Warn)	Warning: warning conditions
5	10 (Info2)	Notice: normal but significant condition
6	9 (Info)	Informational: informational messages
7	5 (Debug)	Debug: debug-level messages

pino

For pino, the following nested keys under the err key are mapped:

Key	OpenTelemetry Attribute
`err.message`	`exception.message`
`err.type`	`exception.type`
`err.stack`	`exception.stacktrace`

Java (MDC)

The contents of the mdc key are lifted to the root level of log record attributes.

For example, mdc.loggerName would be available as an attribute with the key loggerName.

How Dash0 Processes JSON logs