Mapping flat log line dt.trace_id and dt.span_id to fields in OpenShift Loki

[gilles_tabary]

Hello.

I am on Managed.

We activated successfully auto OneAgent feature enrichement of flat log lines, in order to inject transaction & span ids. Fine. In OpenShift, Loki we get the log line :

22 avr. 2026, 16:22:01.354 10.130.50.2 - - [22/Apr/2026:16:21:52 +0200] "GET /health/liveness HTTP/2.0" 200 15 [!dt dt.trace_id=01234567890123456789012345678901, dt.span_id=0123456789012345,dt.trace_sampled=true]

but Loki cannot extract dt.trace_id nor dt.span_id as standard indexable fields like traceid & spanid. Coudl it be due to the leading "!dt" ?

Derived Fields are Graphana specialty : not available in Loki. Transformation into loki label is strongly un-recommended because traceid & spanid are high cardinality, which would lead to Loki index saturation.

Any one did it (on flat log lines i.e. not structured) ? How to map log line elements with loki fields ?

Regards.

[Julius_Loman]

This should be asked in Grafana/Loki forum as it's a Grafana/Loki issue. Since your log is unstructured, you will need to parse it and modify the log pipeline you have (Alloy?) to extract the Dynatrace metadata into standard metadata that you can then use.  Your logging stack is simply not aware of Dynatrace added metadata. 

[gilles_tabary]

Hello.

It could also be rephrased as : why Dynatrace does not inject standard transaction & span id markers, automatically recognised by standard log concentratores. I am aware of one possible answer : Dynatrace allow potential coexisting transaction & span id systems, thus the proprietarry marking.

This is my rational for posting on a Dynatrace forum 🙂 Yet, your point does makes sens.

Let's see if we can share experience.