journald receiver body handling (map) vs other receivers (str)

[Simoliv]

Component(s)

receiver/journald

Describe the issue you're reporting

Hi there, we are using the journald receiver and also get logs shipped from other receivers f.e. via otlp.
As far as I see, the journaldreceiver uses the body field as a map while other receivers use it as strings which inevitably leads to issues in Elastic, where we ship the logs to.

What is the plan for this situation or is it just not possible to use journaldreceiver in combination with other receivers ?

https://opentelemetry.io/docs/specs/otel/logs/data-model/#field-body tells me, body can be structured data or a string, but how should this work at the same time ?

I already tried to transform the journald body["MESSAGE"] back into just body or vice versa, the string fields into some structured data body -> body["MESSAGE"], but his cannot be the idea, huh ?

I appreciate any hints or ideas. best regards

[github-actions]

Pinging code owners:

• receiver/journald: @sumo-drosiek @djaglowski

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[djaglowski]

I don't recall the rationale for deciding that the body would be structured but there is no plan as of now to change it. Feel free to propose a change and articulate where all the data would be placed instead of the body.

If you like you should be able to modify the entries by moving data around. Something like:

operators:
  - type: copy
    from: body
    to: attributes["tmp"]
  - type: remove
    field: attributes["tmp"]["MESSAGE"]
  - type: flatten
    field: attributes["tmp"]
  - type: move
    from: body["MESSAGE"]
    to: body

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

• receiver/journaldreceiver: @sumo-drosiek @djaglowski

See Adding Labels via Comments if you do not have permissions to add labels yourself.