topic Log Ingestion for File Share not attached to any PC in Log Analytics

Log Ingestion for File Share not attached to any PC

Travis2 — Thu, 08 Aug 2024 11:25:03 GMT

I have been researching this and wanted to know if anyone has setup log ingestion rules for a file share that is not attached to a pc. We have software that writes its logs to a NFS share drive, however these shares are not attached to the PC, they are browsable from the host.

I assume the one agent need to be able to see the share location somehow, essentially the location to ingest logs will be something like \\hostname\testLogs\test.json

any documentation or guidance will be appreciated.

Re: Log Ingestion for File Share not attached to any PC

adam_gardner — Fri, 21 Mar 2025 00:55:36 GMT

The Dynatrace OpenTelemetry collector distribution includes two components I think may help here. The filelog receiver (point it at the network share?) and the syslog receiver (if you're looking at syslog formatted data?)

config.yaml

receivers:
  filelog:
    include:
    - \\dcptest01\testLogs\*.json

processors:
  transform/add_timestamps:
    error_mode: ignore
    log_statements:
      - context: string
      statements:
        - set(observed_time, Now())
        - set(time, Now())
exporters:
  otlphttp/dynatrace:
    endpoint: "${env:DT_ENDPOINT}/api/v2/otlp"
    headers:
      Authorization: "Api-Token ${env:DT_API_TOKEN}"
service:
  pipelines:
    logs:
      receivers: [filelog]
      processors: [transform/add_timestamps]
      exporters: [otlphttp/dynatrace]

Then run it in any way you like (Kubernetes cluster, standalone binary on the host, docker etc.)

// Example running as a standalone binary
export DT_ENDPOINT=https://abc12345.live.dynatrace.com
export DT_API_TOKEN=dt0c01.****.****   // This token has logs.ingest permissions
./dynatrace-otel-collector --config=config.yaml

Re: Log Ingestion for File Share not attached to any PC

stephenM — Thu, 06 Mar 2025 16:51:33 GMT

I would like to see this moved into the Dynatrace UI as an extension. Should be as simple as provide full path and a credential from the cred vault. Assign it to a location of Activegates so the workload can be HA.