Openetelemtry output: composes a "structured" body, but not creates attributes instead - is that correct (and is there a way to change it)?

[dsobolev-nr]

Hi there.

I guess this is expected behavior, I just wonder if there is any way to change it.
So we have an example log record:

Jan 18 18:45:31 ip-10-0-3-0 newrelic-infra-service: time="2023-01-18T18:45:31Z" level=error msg="Error occurred while handling the process" component=integrations.Supervisor error="signal: aborted" process=log-forwarder

and the following opentelemtry payload shows up:

{"resourceLogs":[{"resource":{},"scopeLogs":[{"scope":{},"logRecords":[{"timeUnixNano":"1674067533806629601","body":{"kvlistValue":{"values":[{"key":"filePath","value":{"stringValue":"/var/log/messages"}},{"key":"log","value":{"stringValue":"Jan 18 18:45:31 ip-10-0-3-0 newrelic-infra-service: time=\"2023-01-18T18:45:31Z\" level=error msg=\"Error occurred while handling the process\" component=integrations.Supervisor error=\"signal: aborted\" process=log-forwarder"}},{"key":"fb.input","value":{"stringValue":"tail"}},

So all attributes (appeared after parsing) go to the body, while I would expect them to be added as attributes to logRecords.
Is there any way to achieve this?

Thank you!

[patrick-stephens]

Are you parsing the input from the tail plugin? What's your full config?
https://docs.fluentbit.io/manual/pipeline/parsers

The default behaviour of tail is to add everything to a log key unless it is handled by a parser (a log file can be in any format - or even no format!): https://docs.fluentbit.io/manual/pipeline/inputs/tail

You can probably see this with stdout output so I would have a look at that as well. If you parse it you will end up with key-value pairs but I'm not sure exactly what you want in the output so might be worthwhile to try a parser and see - then update with an expected output vs actual.

[dsobolev-nr]

Hi.

Thanks for the reply.

This is New Relic infra agent & FLuent Bit integration. Input is tail - "key":"fb.input","value":{"stringValue":"tail"}.
Standard parsers are used, and I'm absolutely happy with the key-value pairs on the output, I just want them to be added as field attributes , but not as a key-value structured body. I'm pretty sure, there is no error in implementation, my request is quite special, I just wanted to make sure there is no way to make this happen with some non-trivial FluentBit capabilities :). Otherwise I would just need to implement some custom opentelemetry collector processor for this functionality.

Thanks again

[INPUT]
    Name tail
    Path /var/log/messages
    Buffer_Max_Size 128k
    Skip_Long_Lines On
    Path_Key filePath
    Tag  basic-file
    DB   /var/db/newrelic-infra/newrelic-integrations/logging/fb.db

[PARSER]
    Name        rfc5424
    Format      regex
    Regex       ^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*)\]|-)) (?<message>.+)$
    Time_Key    time
    Time_Format %Y-%m-%dT%H:%M:%S.%L%z
    Time_Keep   On

[PARSER]
    Name        rfc3164-local
    Format      regex
    Regex       ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$
    Time_Key    time
    Time_Format %b %d %H:%M:%S
    Time_Keep   On

[PARSER]
    Name        rfc3164
    Format      regex
    Regex       /^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/
    Time_Key    time
    Time_Format %b %d %H:%M:%S
    Time_Format %Y-%m-%dT%H:%M:%S.%L
    Time_Keep   On

[Syn3rman]

Can you send the output of stdout or the config files so that I can reproduce it?
If you think record accessor is helpful in this case, it might be worth waiting for it being added in the output opentelemetry as well (I started work on it but got sidetracked).

I'm not sure what the record exactly looks like but if all attributes are under a single key, you could set the attribute_key (similar to the trace_id_key I've implemented) to specify the field containing the attributes