topic Re: JSON logs from OneAgent on K8S vs from Log Ingest API in Log Analytics

Logs in JSON from OneAgent on K8S vs Logs from Log Ingest API

Aymeric_M — Thu, 18 Dec 2025 08:50:16 GMT

Hi,

There is a weird difference in Logs New (and also in Classic) between logs in JSON format received from K8S by OneAgent and logs in JSON format received from the Log Ingest API.

The logs from the API seem to be pre-parsed and all the attributes are available as fields for filtering whereas logs from OneAgent are not and we have to switch to DQL query mode and add JSON parsing commands.

Is there a way to have the logs coming from OneAgent pre-parsed ?

Note that I already checked if we have a preprocessing rule that would apply on logs from the API and it is not the case.

Re: JSON logs from OneAgent on K8S vs from Log Ingest API

AntonPineiro — Tue, 03 Jun 2025 16:34:40 GMT

Hi,

You can use for OpenPipeline processing and parse your logs.

Best regards

Re: JSON logs from OneAgent on K8S vs from Log Ingest API

Aymeric_M — Wed, 04 Jun 2025 08:57:17 GMT

Yeah, I know that, but I don't know the content of the logs in advance.
Is there a DQL or DPL command that will extract all the attributes into fileds without the need to declare each and every one ?
So far all the examples in the documentation presuppose that we know the name of the attributes that we want to put into fields.