Mapping of journald entries

[ronmacdonald]

I enabled journald monitoring for our system logs on EC2 for our k8 cluster.  Looking at raw log content, it appears some fields are mapped and others are missing.  The support page mentions a few fields that it is mapping but several others appear to be dropped (i.e. _PID, _CMDLINE...).  Am I able to get insight and modify the processing rules for these logs?

[piotr_zemlis]

From OneAgent perspective - unfortunately, no. What is stated here in docs https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-log-ingestion/lma-log-ingestion-vi... is hardcoded in log module. Gaining other fields would require some enhancements in the code base.

[StefanPostma]

Yes you can, in Openpipeline you can add new pipelines which will be processed in order of sequence.

while adding a processor you can add an example log you have in Dynatrace already to test your parsing rule.

I just took a simple JSON as an example here, just to visualize the context. More information on the setup and examples can be found here: https://docs.dynatrace.com/docs/shortlink/openpipeline-processing-examples