Message

The following keys are mapped to the log record body (first match wins):

@m
msg
message
log
output
MESSAGE

Log level

The following keys are mapped to the log record severity number (first match wins):

log.level
level
s
priority
@l
_logLevel

Severity mapping

The severity in the previously listed fields is mapped to the log record severity number as follows:

Value	Severity number
`finest`	1 (`Trace`)
`t`	1 (`Trace`)
`trace`	1 (`Trace`)
`loglevel.trace`	1 (`Trace`)

Value	Severity number
`v`	5 (`Debug`)
`verbose`	5 (`Debug`)
`d`	5 (`Debug`)
`d1`	5 (`Debug`)
`d2`	6 (`Debug2`)
`d3`	7 (`Debug3`)
`d4`	8 (`Debug4`)
`d5`	8 (`Debug4`)
`dbg`	5 (`Debug`)
`debug`	5 (`Debug`)
`finer`	5 (`Debug`)
`fine`	6 (`Debug2`)
`config`	7 (`Debug3`)
`loglevel.debug`	5 (`Debug`)

Value	Severity number
`i`	9 (`Info`)
`inf`	9 (`Info`)
`info`	9 (`Info`)
`information`	9 (`Info`)
`informational`	9 (`Info`)
`loglevel.information`	9 (`Info`)
`notice`	10 (`Info2`)

Value	Severity number
`w`	13 (`Warn`)
`wrn`	13 (`Warn`)
`warn`	13 (`Warn`)
`warning`	13 (`Warn`)
`loglevel.warning`	13 (`Warn`)

Value	Severity number
`e`	17 (`Error`)
`err`	17 (`Error`)
`error`	17 (`Error`)
`severe`	17 (`Error`)
`loglevel.error`	17 (`Error`)
`critical`	18 (`Error2`)
`dpanic`	18 (`Error2`)
`alert`	19 (`Error3`)
`panic`	19 (`Error3`)

Value	Severity number
`f`	21 (`Fatal`)
`fatal`	21 (`Fatal`)
`emergency`	21 (`Fatal`)
`loglevel.critical`	21 (`Fatal`)

Service name

The following keys are mapped to the service.name attribute (first match wins):

service_name
serviceName
otelServiceName

Timestamp

The following keys are mapped to the log record time (first match wins):

@timestamp
timestamp
@t
time
ts
date_time

Trace ID

The following keys are mapped to the Trace ID (first match wins):

trace_id
trace.id
traceId
@tr
otelTraceID

Note: Only hex-encoded strings with exactly 16 bytes (32 hex characters) are eligible as Trace ID.

Span ID

The following keys are mapped to the Span ID (first match wins):

span_id
span.id
spanId
@sp
otelSpanID

Note: Only hex-encoded strings with exactly 8 bytes (16 hex characters) are eligible as Span ID.

Trace sampling

If the otelTraceSampled key exists and has a boolean value, it will be used to set the trace flag SAMPLED accordingly.

journald (systemd)

If a journal entry is detected (includes a key named __CURSOR), the following keys are mapped to their corresponding log record attribute according to the OpenTelemetry Semantic Conventions:

Key	OpenTelemetry attribute
`_HOSTNAME`	`host.name`
`_MACHINE_ID`	`host.id`
`_PID`	`process.pid`
`_COMM`	`process.executable.name`
`_EXE`	`process.executable.path`
`_CMD`	`process.command`
`_CMDLINE`	`process.command_line`
`_UID`	`process.owner`
`_TRANSPORT`	`log.iostream`
`_SYSTEMD_CGROUP`	`process.linux.cgroup`

Additionally, the _SOURCE_REALTIME_TIMESTAMP key is mapped to the log record timestamp if it exists and has an integer number as value.

Severity mapping

The priority in the PRIORITY field of a journal entry is mapped to log record severity number as follows:

Priority	Severity number	Description
0	24 (`Fatal4`)	Emergency: system is unusable
1	21 (`Fatal`)	Alert: action must be taken immediately
2	18 (`Error2`)	Critical: critical conditions
3	17 (`Error`)	Error: error conditions
4	13 (`Warn`)	Warning: warning conditions
5	10 (`Info2`)	Notice: normal but significant condition
6	9 (`Info`)	Informational: informational messages
7	5 (`Debug`)	Debug: debug-level messages

pino

For pino, the following nested keys under the err key are mapped:

Key	OpenTelemetry attribute
`err.message`	`exception.message`
`err.type`	`exception.type`
`err.stack`	`exception.stacktrace`

Java (MDC)

The contents of the mdc key are lifted to the root level of log record attributes.

For example, mdc.loggerName would be available as an attribute with the key loggerName.

Detailed JSON Matching Rules