Example Vector remap for Docker to OTLP
parsed, err = parse_json(.message)
if err == null {
.severity_text = "UNSPECIFIED"
.severity_number = 0
level = downcase(string(parsed.level) ?? "")
if level == "trace" {
.severity_text = "TRACE"
.severity_number = 1
} else if level == "debug" {
.severity_text = "DEBUG"
.severity_number = 5
} else if level == "info" {
.severity_text = "INFO"
.severity_number = 9
} else if level == "warn" || level == "warning" {
.severity_text = "WARN"
.severity_number = 13
} else if level == "error" {
.severity_text = "ERROR"
.severity_number = 17
} else if level == "fatal" || level == "panic" {
.severity_text = "FATAL"
.severity_number = 21
}
}
resourceLogs,err = [{
"resource": {
"attributes": [
{ "key": "source_type", "value": { "stringValue": .source_type } },
{ "key": "service.name", "value": { "stringValue": .container_name} },
{ "key": "net.host.ip", "value": { "stringValue": .source_ip } },
{ "key": "host.hostname", "value": { "stringValue": .host } }
]
},
"scopeLogs": [{
"scope": {
"name": .msgid
},
"logRecords": [{
"timeUnixNano": to_unix_timestamp!(.timestamp, unit: "nanoseconds"),
"body": { "stringValue": .message },
"severityText": .severity_text,
"severityNumber": .severity_number,
"attributes": [
{ "key": "syslog.procid", "value": { "stringValue": to_string(.procid) } },
{ "key": "syslog.facility", "value": { "stringValue": .facility } },
{ "key": "syslog.version", "value": { "stringValue": to_string(.version) } },
{ "key": "docker.container.id", "value": { "stringValue": to_string(.container_id) } },
{ "key": "docker.image", "value": { "stringValue": .image } },
{ "key": "docker.stream", "value": { "stringValue": to_string(.stream) } },
{ "key": "docker.container.created", "value": { "stringValue": to_string(.container_created_at) } }
]
}]
}]
}]
del(.message)
del(.timestamp)
del(.service)
del(.source_type)
del(.appname)
del(.facility)
del(.host)
del(.hostname)
del(.severity)
del(.source_ip)
del(.severity_number)
del(.severity_text)
assert!(err == null,message:err)
.resourceLogs = resourceLogs