[pkg/translator/azurelogs] Support additional fields not in the common schema

[rafaelrodrigues3092]

Component(s)

pkg/translator/azurelogs

What happened?

Description

Azure resource logs are, unfortunately, not standard.
Although many services adhere to the azure resource common schema, there are plenty of service-specific schemas, see Common and service-specific schemas for Azure resource logs.

I am looking to have the azurelogs translator package expand support for some additional time and property fields in order to support Azure Service Bus and Event Hubs:

• Alternative timestamp fields: EventTimeString,EventTimestamp,startTime
• Alternative properties field: EventProperties

In addition to the fields above, it's really difficult to identify the resources and categories causing the parsing issues.
I would suggest adding additional context to the parsing error message to identify the resource causing the parsing issue.

Steps to Reproduce

Configure Azure resource logs for Azure Service Bus and/or Azure Event Hub
Example payload

{
  "records": [
    {
      "Environment": "PROD",
      "Region": "East US 2",
      "ScaleUnit": "PROD-BN3-008",
      "ActivityId": "<ACTIVITY_ID>",
      "EventName": "Retrieve Topic",
      "resourceId": "/SUBSCRIPTIONS/<SUBSCRIPTION_ID>/RESOURCEGROUPS/<RESOURCE_GROUP>/PROVIDERS/MICROSOFT.SERVICEBUS/NAMESPACES/<NAMESPACE>",
      "SubscriptionId": "<SUBSCRIPTION_ID>",
      "EventTimeString": "2/11/2026 8:22:02 AM +00:00",
      "EventProperties": "{\"SubscriptionId\":\"<SUBSCRIPTION_ID>\",\"Namespace\":\"<NAMESPACE>\",\"Via\":\"https://<NAMESPACE>.servicebus.windows.net/conversation_notification_topic?api-version=2017-04&enrich=False\",\"TrackingId\":\"<TRACKING_ID>\"}",
      "Status": "Succeeded",
      "Caller": "ServiceBus Client",
      "category": "OperationalLogs"
    },
    {
      "Environment": "PROD",
      "Region": "East US 2",
      "ScaleUnit": "PROD-BN3-008",
      "ActivityId": "<ACTIVITY_ID>",
      "SubscriptionId": "<SUBSCRIPTION_ID>",
      "NamespaceName": "<NAMESPACE>",
      "EntityType": "Topic",
      "EntityName": "billingtopic",
      "ChildEntityType": "Subscription",
      "ChildEntityName": "<CHILD_ENTITY_NAME>",
      "ActivityName": "ReceiveMessage",
      "ResourceId": "/SUBSCRIPTIONS/<SUBSCRIPTION_ID>/RESOURCEGROUPS/<RESOURCE_GROUP>/PROVIDERS/MICROSOFT.SERVICEBUS/NAMESPACES/<NAMESPACE>",
      "OperationResult": "ClientError",
      "ErrorCount": 1,
      "EventTimestamp": "2/11/2026 8:23:14.135 PM +00:00",
      "ErrorMessage": "the messaging entity '<NAMESPACE>:topic:billingtopic|<CHILD_ENTITY_NAME>' could not be found. to know more visit https://aka.ms/sbresourcemgrexceptions.  trackingid:<TRACKING_ID>, systemtracker:gi::g1:213993925:79221a51-fabc-42ba-afd6-efc5283230e5;5209044:6054502:6054503:source(address:billingtopic/subscriptions/<CHILD_ENTITY_NAME>):messagereceiver6billingtopic/subscriptions/<CHILD_ENTITY_NAME>, bi::link99997480(213993926_g1), timestamp:2026-02-11t20:22:26",
      "category": "DiagnosticErrorLogs"
    }
  ]
}

Expected Result

Proper parsing of Azure Resource logs for Azure Service Bus and Event Hub.

Actual Result

Parsing errors.

Collector version

v0.145.0

Environment information

Environment

OS: Windows and Ubuntu

OpenTelemetry Collector configuration

exporters:
  debug:
    verbosity: basic

receivers:
  azureeventhub/logs:
    connection: Endpoint=sb://<NAMESPACE>.servicebus.windows.net/;SharedAccessKeyName=<KEY_NAME>;SharedAccessKey=<SHARED_ACCESS_KEY>;EntityPath=logs
    apply_semantic_conventions: true
    format: 'azure'
    group: 'otel-test'
    partition: '0'
    offset: '0'    
    time_formats:
      logs:
        [
          '01/02/2006 15:04:05',
          '2006-01-02 15:04:05',
          '2006-01-02T15:04:05Z07:00',
          '1/2/2006 3:04:05.000 PM -07:00',
          '1/2/2006 3:04:05 PM -07:00'
        ]
    max_poll_events: 100
    poll_rate: 5
  
service:
  pipelines:
    logs:
      receivers:
      - azureeventhub/logs
      processors: []      
      exporters:
      - debug
  telemetry:
    logs:
      level: debug

Log output

Feature gate "receiver.azureeventhubreceiver.UseAzeventhubs" is stable and already enabled. It will be removed in version 0.144.0 and continued use of the gate after version 0.144.0 will result in an error.
{"level":"info","ts":"2026-02-16T13:34:13.529Z","caller":"memorylimiter@v0.145.0/memorylimiter.go:71","msg":"Memory limiter configured","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.kind":"processor","limit_mib":8192,"spike_limit_mib":1024,"check_interval":1}
{"level":"warn","ts":"2026-02-16T13:34:13.530Z","caller":"builders/builders.go:40","msg":"\"azureeventhub\" alias is deprecated; use \"azure_event_hub\" instead","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs"}
{"level":"info","ts":"2026-02-16T13:34:13.551Z","caller":"service@v0.145.0/service.go:241","msg":"Starting otelcol-contrib...","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"Version":"0.145.0","NumCPU":8}
{"level":"info","ts":"2026-02-16T13:34:13.911Z","caller":"service@v0.145.0/service.go:264","msg":"Everything is ready. Begin running and processing data.","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"}}
{"level":"warn","ts":"2026-02-16T13:36:05.919Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}
{"level":"warn","ts":"2026-02-16T13:36:39.606Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}
{"level":"warn","ts":"2026-02-16T13:38:58.519Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}
{"level":"warn","ts":"2026-02-16T13:44:07.475Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}
{"level":"warn","ts":"2026-02-16T14:13:21.052Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}
{"level":"warn","ts":"2026-02-16T14:24:26.260Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}
{"level":"warn","ts":"2026-02-16T14:45:43.356Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}
{"level":"warn","ts":"2026-02-16T15:05:34.921Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}
{"level":"warn","ts":"2026-02-16T15:16:06.052Z","caller":"azurelogs@v0.145.0/resourcelogs_to_logs.go:179","msg":"Unable to convert timestamp from log","resource":{"service.instance.id":"495643d8-79ad-449d-a412-d80e019811f7","service.name":"otelcol-contrib","service.version":"0.145.0"},"otelcol.component.id":"azureeventhub/logs","otelcol.component.kind":"receiver","otelcol.signal":"logs","timestamp":""}

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[github-actions]

Pinging code owners:

• pkg/translator/azurelogs: @atoulme @cparkins @MikeGoldsmith @constanca-m

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[rafaelrodrigues3092]

@atoulme @cparkins @MikeGoldsmith @constanca-m

I would like to take a shot at this issue, if possible

[rafaelrodrigues3092]

Attempt at the fix in #46165

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

• pkg/translator/azurelogs: @atoulme @cparkins @MikeGoldsmith @constanca-m

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[MikeGoldsmith]

Not stale - the PR is still open.