JSON Logs

Introduction

Dash0 natively supports OpenTelemetry Logs, which provide log information based on its Semantic Conventions. Only a few solutions provide OpenTelemetry logs natively. However, many systems offer structured logging (in JSON format), which allow you to add semantics to your log information.

For other solutions not following OpenTelemetry's Semantic Conventions, the log data "level":"warn" Copywould only be text. Dash0 is aware that the value warnCopy in that field levelCopy makes the log record a warning and can treat it as such.

How it works

Dash0 parses all log records' bodies as a string containing a JSON data structure. Fields like severity and message can be extracted from that structure and used as semantic information.

Currently, the following log formats are supported:

• Kubernetes System Logs
• Log severity mapping as defined within the OpenTelemetry specification
• Elastic Common Schema Logs
• Serilog
• Journald
• and more…

Example

The log record:

12345678
{
  "level": "info",
  "message": "Request to /",
  "span_id": "93b6f3cf8ce8e712",
  "timestamp": "2024-07-01T18:09:06.535Z",
  "trace_flags": "01",
  "trace_id": "027e383aa083bc5c4165a9c7abbe5694"
}

has been read on the source system and forwarded to Dash0. The entire message would be displayed as the body of the log record.

When this log records is processed by Dash0, it converts the fields in the JSON payload to attributes and maps them to relevant context fields such as span_idCopy and trace_idCopy:

How it Works

The processor identifies potential JSON logs through the following process:

1. Examines log record body
2. For string bodies, checks if the content starts with {Copy and ends with }Copy
3. Attempts to parse the content as JSON
4. If successful, processes the resulting JSON object for known fields

If a log already has a severity number or text assigned, the processor assumes it has already been processed and skips further JSON parsing (with an exception for Vercel log drain logs which receive special handling).