JSON logs from OneAgent on K8S vs from Log Ingest API

[Aymeric_M]

Hi,

There is a weird difference in Logs New (and also in Classic) between logs in JSON format received from K8S by OneAgent and logs in JSON format received from the Log Ingest API.

The logs from the API seem to be pre-parsed and all the attributes are available as fields for filtering whereas logs from OneAgent are not and we have to switch to DQL query mode and add JSON parsing commands.

Is there a way to have the logs coming from OneAgent pre-parsed ?

Note that I already checked if we have a preprocessing rule that would apply on logs from the API and it is not the case.

[AntonPineiro]

Hi,

You can use for OpenPipeline processing and parse your logs.

Best regards

[Aymeric_M]

Yeah, I know that, but I don't know the content of the logs in advance.
Is there a DQL or DPL command that will extract all the attributes into fileds without the need to declare each and every one ?
So far all the examples in the documentation presuppose that we know the name of the attributes that we want to put into fields.