Log ingestion using AWS Firelense(fluentbit) sidecar with ECS Farget

[andrei-morozov]

Hello, I've followed the guide https://docs.dynatrace.com/docs/shortlink/int-aws-fargate#buildtime. I have an ECS service with two tasks, one the web server (node.js) the other is running fluentbit. The AWS Log driver is setup as firelens. This ensures all logs are ingested into the fluentbit sidecar.

The logs are being ingested into Dynatrace, however they are NOT associated with the particular service. This means any David.AI problems that come from the logs are missing. This also leads to issues such as developer unable to quickly find the logs as they are not attached in the new 'services' app.

How can I ensure those logs are attached, is there a different ingestion pattern for this type of setup?

[andrei-morozov]

my understanding is by using fluentbit - we're actually using Dynatrace API log ingestion. Is there a specific value I need to send that would make DT attach those logs to the respective service, or some value within the log that would attach them?

[TomLichti]

You didn't mention what the technology is for the app in the container, but we had good luck with making sure that the OneAgent features for metadata enrichment are enabled, and then in a pipeline extract the trace and topology data (dt.entity.process_group and dt.entity.processgroupinstance, for example) into the respective fields. Then you get the 'Open trace' links in logs, and the logs will be associated with the right entities.