Filter Logs in Dynatrace Managed which comes from Open Telemetry

[deni]

Hi,

I need to filter logs in the Classic log viewer in Dynatrace Managed (so I don’t have DQL).
My goal is to see only the logs that come from OpenTelemetry.

I tried filtering like this:

telemetry.sdk.name="opentelemetry"

because I saw that this field exists in the metadata, but it returns empty results.

I also tried with another field:

otel.scope.name != null

but the result is the same — nothing.

I saw these field on the left menu, others when I'm in advanced mode. When I'm on simple mode - they disappear.

This is one of these messages:

{
  "event.type": "LOG",
  "content": "⚠️ A warning log from VB.NET via OpenTelemetry.",
  "status": "WARN",
  "timestamp": "1755598171325",
  "loglevel": "WARN",
  "service.name": "unknown_service:dotnet",
  "trace_id": "000000000000000091486389365d72b5",
  "span_id": "c2d90c8a4b402a94",
  "telemetry.sdk.language": "dotnet",
  "otel.scope.name": "SSB.Platform.Internal.Objects_Holder.MyService",
  "telemetry.sdk.version": "1.12.0",
  "dt.auth.origin": "dt0c01.34YVNTMSQYIHYZIXSPVJ2OVK",
  "telemetry.sdk.name": "opentelemetry"
}

Can you suggest how I can achieve this?

Regards, Deni

[dannemca]

Try with the dt.auth.origin, which should be the Token id you have created for the OTEL integration... assuming the token is used only for OTEL ingestion.

if this still not works, try to add the field as custom attribute in the log settings. https://docs.dynatrace.com/managed/analyze-explore-automate/log-monitoring/analyze-log-data/log-cust... 

[deni]

Thanks for the suggestion. Unfortunately in Dynatrace Managed "dt.auth.origin" is also part of metadata which can't be filtered (How I miss DQL  ...). I read the documentation: https://docs.dynatrace.com/docs/analyze-explore-automate/log-monitoring/analyze-log-data/log-custom-...

"These custom attributes must match log attributes in ingested log data or they will be ignored."

So if I understand this correct these attributes, which I can use in filter are the same which are visible on the left menu "Available attributes" in the Logs screen, but only in Simple mode (in Advanced mode not filterable attributes are also shown). I looked at them one by one, but couldn't find anything useful.

May be my solution is only for future logs (can't filter current logs) - process rule to set log.source to opentelemetry or add in the collector additional attribute (log.source - I can't find something more meaningful in available attributes for my case). 

[dannemca]

I would suggest you to set the field 'otel.scope.name' as custom arribute and give it a try.

[deni]

Where to set it is there any other place? It is already inside the record together with telemetry.sdk.name, but if I try to filter the result is empty. The json I pasted is generated as follow: Open the record and press "Create process rule" - this json comes as a value in the field on the bottom of rule where I can test it.

[dannemca · Accepted solution]

Settings > Log Monitoring > Custom attributes

add the attribute there and check the Show values in side bar.

[deni]

Thanks, this looks like the simplest solution and should work. I’ll test it once we have new logs.

According to the description, it only applies to newly ingested logs:

Log Monitoring Classic → The change applies only to newly ingested log events. Existing events (before toggling the option) won’t be searchable.