The otelp exception.message will be used for the ecs message instead of the body field

Kibana version:
8.10.2

Elasticsearch version:
8.10.2

APM Server version:
8.10.2

APM Agent language and version:
No idea where I can find this.

Original install method (e.g. download page, yum, deb, from source, etc.) and version:
I'm using an existing elastic cloud instance.

Is there anything special in your setup?
No.

Description of the problem including expected versus actual behavior. Please include screenshots (if relevant):
I'm collecting my log messages (created by a dotnet application) with a otel-collector and sending it to the Elastic APM-server. The messages which will be sent to the server are in the OpenTelemetry protocol (OTLP) standard including exception details via https (see Attachment [1]). The logs are received and converted into the Elastic Common Scheme (ECS) almost like expected.

But the exception message will be used for the message which is not my expectation:

{
  "_index": ".ds-logs-mynamespace_myservice_app-staging-2024.02.19-000001",
  "_id": "xxxxxxxxxxxxxx",
  "_version": 1,
  "_score": 0,
  "_source": {
	...
    // expected: The exception has been caught and suppressed.
    "message": "Operation is not valid due to the current state of the object.",
    "labels": {
      "{OriginalFormat}": "The exception has been caught and suppressed."
    },
    "timestamp": {
      "us": 1708333056109342
    }
  },
  "fields": {
	  ...
  }
}

Can anyone help me please?

Regards
Hardy

Provide logs and/or server output (if relevant):

Attachment [1]:

{
    "resourceLogs": [
        {
            "resource": {
                "attributes": [
                    {
                        "key": "deployment.environment",
                        "value": {
                            "stringValue": "Staging"
                        }
                    },
                    {
                        "key": "service.name",
                        "value": {
                            "stringValue": "MyNamespace.MyApplication"
                        }
                    },
                    {
                        "key": "service.namespace",
                        "value": {
                            "stringValue": "MyNamespace"
                        }
                    },
                    {
                        "key": "service.instance.id",
                        "value": {
                            "stringValue": "12345678-1234-1234-1234-012345678901"
                        }
                    },
                    {
                        "key": "telemetry.sdk.name",
                        "value": {
                            "stringValue": "opentelemetry"
                        }
                    },
                    {
                        "key": "telemetry.sdk.language",
                        "value": {
                            "stringValue": "dotnet"
                        }
                    },
                    {
                        "key": "telemetry.sdk.version",
                        "value": {
                            "stringValue": "1.7.0"
                        }
                    }
                ]
            },
            "scopeLogs": [
                {
                    "scope": {
                        "name": "MyNamespace.MyService"
                    },
                    "logRecords": [
                        {
                            "timeUnixNano": "1708113451408050200",
                            "observedTimeUnixNano": "1708113451408050200",
                            "severityNumber": 13,
                            "severityText": "Warning",
                            "body": {
                                "stringValue": "The exception has been caught and suppressed."
                            },
                            "attributes": [
                                {
                                    "key": "exception.type",
                                    "value": {
                                        "stringValue": "InvalidOperationException"
                                    }
                                },
                                {
                                    "key": "exception.message",
                                    "value": {
                                        "stringValue": "Operation is not valid due to the current state of the object."
                                    }
                                },
                                {
                                    "key": "exception.stacktrace",
                                    "value": {
                                        "stringValue": "System.InvalidOperationException: Operation is not valid due to the current state of the object.\r\n   at MyNamespace.MyService.MyMethod(CancellationToken cancellationToken)"
                                    }
                                },
                                {
                                    "key": "{OriginalFormat}",
                                    "value": {
                                        "stringValue": "The exception has been caught and suppressed."
                                    }
                                }
                            ],
                            "traceId": "f472e5cd368dc8d8efeb5a0cce6d8922",
                            "spanId": "2de4a2e94e0c75e4"
                        }
                    ]
                }
            ]
        }
    ]
}
{
  "_index": ".ds-logs-mynamespace_myservice_app-staging-2024.02.19-000001",
  "_id": "xxxxxxxxxxxxxx",
  "_version": 1,
  "_score": 0,
  "_source": {
    "observer": {
      "hostname": "xxxxxxxxxxxxxx",
      "type": "apm-server",
      "version": "8.10.2"
    },
    "agent": {
      "name": "opentelemetry/dotnet",
      "version": "1.7.0"
    },
    "@timestamp": "2024-02-19T08:57:36.109Z",
    "log": {
      "level": "Error"
    },
    "data_stream": {
      "namespace": "staging",
      "type": "logs",
      "dataset": "mynamespace_myservice_app"
    },
    "service": {
      "node": {
        "name": "xxxxxxxxxxxxxx"
      },
      "environment": "Staging",
      "name": "MyNamespace.MyService",
      "language": {
        "name": "dotnet"
      }
    },
    "error": {
      "exception": [
        {
          "handled": true,
          "message": "Operation is not valid due to the current state of the object.",
          "type": "InvalidOperationException"
        }
      ],
      "id": "xxxxxxxxxxxxxx",
      "stack_trace": "System.InvalidOperationException: Operation is not valid due to the current state of the object.\r\n   at MyNamespace.MyService.MyMethod(CancellationToken cancellationToken)",
      "grouping_key": "xxxxxxxxxxxxxx",
      "grouping_name": "Operation is not valid due to the current state of the object."
    },
    "event": {
      "severity": 17,
      "kind": "event",
      "type": "error"
    },
    "message": "Operation is not valid due to the current state of the object.",
    "labels": {
      "{OriginalFormat}": "The exception has been caught and suppressed."
    },
    "timestamp": {
      "us": 1708333056109342
    }
  },
  "fields": {
    "error.grouping_key": [
      "fc613fbe77eb66020418fedc6b5784ac"
    ],
    "error.exception.type": [
      "InvalidOperationException"
    ],
    "service.node.name": [
      "xxxxxxxxxxxxxx"
    ],
    "service.language.name": [
      "dotnet"
    ],
    "service.node.name.text": [
      "xxxxxxxxxxxxxx"
    ],
    "agent.name.text": [
      "opentelemetry/dotnet"
    ],
    "log.level": [
      "Warning"
    ],
    "agent.name": [
      "opentelemetry/dotnet"
    ],
    "event.kind": [
      "event"
    ],
    "event.severity": [
      17
    ],
    "service.environment": [
      "Staging"
    ],
    "service.name": [
      "Amp_Ap_TsCalc_Lambda"
    ],
    "data_stream.namespace": [
      "staging"
    ],
    "service.language.name.text": [
      "dotnet"
    ],
    "error.exception.handled": [
      true
    ],
    "message": [
      "Operation is not valid due to the current state of the object."
    ],
    "data_stream.type": [
      "logs"
    ],
    "observer.hostname": [
      "xxxxxxxxxxxxxx"
    ],
    "timestamp.us": [
      1708333056109342
    ],
    "@timestamp": [
      "2024-02-19T08:57:36.109Z"
    ],
    "observer.type": [
      "apm-server"
    ],
    "observer.version": [
      "8.10.2"
    ],
    "service.name.text": [
      "MyNamespace.MyService"
    ],
    "data_stream.dataset": [
      "mynamespace_myservice_app"
    ],
    "error.id": [
      "xxxxxxxxxxxxxx"
    ],
    "event.type": [
      "error"
    ],
    "agent.version": [
      "1.7.0"
    ],
    "error.grouping_name": [
      "Operation is not valid due to the current state of the object."
    ],
    "error.stack_trace": [
      "System.InvalidOperationException: Operation is not valid due to the current state of the object.\r\n   at MyNamespace.MyService.MyMethod(CancellationToken cancellationToken)"
    ],
    "error.stack_trace.text": [
      "System.InvalidOperationException: Operation is not valid due to the current state of the object.\r\n   at MyNamespace.MyService.MyMethod(CancellationToken cancellationToken)"
    ],
    "labels.service_namespace": [
      "MyNamespace"
    ],
    "error.exception.message": [
      "Operation is not valid due to the current state of the object."
    ],
    "labels.{OriginalFormat}": [
      "The exception has been caught and suppressed."
    ]
  }
}

Also it is not clear for me where the logic is located which converts the messages from the OpenTelemetry Protocol (OTLP) to the Elastic Common Scheme (ESC). Is this something I can adapt or is it immutable?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.