topic Mapping of journald entries in Log Analytics

Mapping of journald entries

ronmacdonald — Mon, 16 Jun 2025 06:27:55 GMT

I enabled journald monitoring for our system logs on EC2 for our k8 cluster. Looking at raw log content, it appears some fields are mapped and others are missing. The support page mentions a few fields that it is mapping but several others appear to be dropped (i.e. _PID, _CMDLINE...). Am I able to get insight and modify the processing rules for these logs?

Re: Mapping of journald entries

piotr_zemlis — Wed, 18 Mar 2026 14:01:08 GMT

From OneAgent perspective - unfortunately, no. What is stated here in docs https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-log-ingestion/lma-log-ingestion-via-oa/lma-logs-from-journald#attributes-selected-in-journald is hardcoded in log module. Gaining other fields would require some enhancements in the code base.

Re: Mapping of journald entries

StefanPostma — Wed, 18 Mar 2026 13:11:34 GMT

Yes you can, in Openpipeline you can add new pipelines which will be processed in order of sequence.

while adding a processor you can add an example log you have in Dynatrace already to test your parsing rule.

I just took a simple JSON as an example here, just to visualize the context. More information on the setup and examples can be found here: https://docs.dynatrace.com/docs/shortlink/openpipeline-processing-examples