Log

• General Log Attributes
• Log File Attributes
• Log Record Attributes

General Log Attributes

This document defines log attributes

Attributes:

Key	Stability	Value Type	Description	Example Values
log.iostream		string	The stream associated with the log. See below for a list of well-known values.	stdout; stderr

log.iostream has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.

Value	Description	Stability
stderr	Events from stderr stream
stdout	Logs from stdout stream

Log File Attributes

Attributes for a file to which log was emitted.

Attributes:

Key	Stability	Value Type	Description	Example Values
log.file.name		string	The basename of the file.	audit.log
log.file.name_resolved		string	The basename of the file, with symlinks resolved.	uuid.log
log.file.path		string	The full path to the file.	/var/log/mysql/audit.log
log.file.path_resolved		string	The full path to the file, with symlinks resolved.	/var/lib/docker/uuid.log

Log Record Attributes

This document defines the generic attributes that may be used in any Log Record.

Attributes:

Key	Stability	Value Type	Description	Example Values
log.record.original		string	The complete original Log Record. [1]	77 <86>1 2015-08-06T21:58:59.694Z 192.168.2.133 inactive - - - Something happened; [INFO] 8/3/24 12:34:56 Something happened
log.record.uid		string	A unique identifier for the Log Record. [2]	01ARZ3NDEKTSV4RRFFQ69G5FAV

[1] log.record.original: This value MAY be added when processing a Log Record which was originally transmitted as a string or equivalent data type AND the Body field of the Log Record does not contain the same value. (e.g. a syslog or a log record read from a file.)

[2] log.record.uid: If an id is provided, other log records with the same id will be considered duplicates and can be removed safely. This means, that two distinguishable log records MUST have different values. The id MAY be an Universally Unique Lexicographically Sortable Identifier (ULID), but other identifiers (e.g. UUID) may be used as needed.