Required Schema for Mezmo Log Analysis Destination
If you choose to restore data to the Mezmo Log Analysis Destination, it must conform to the schema shown in this topic.
This schema is what appears in the message property within the Pipeline. The contents of message is what is sent to the archive.
Primary Fields
| Field Name | Description |
|---|---|
_line | (required) This is the content of the log line to be displayed in the collapsed line viewer. |
_ts | (required) The epoch timestamp. |
_logtype | Helps lineviewer decide which renderer to use when line is expanded. Valid values are |
level | Indicates the level of severity and it displayed in the collapsed line. |
_label | JSON Object containing the key and values of labels appearing as yellow chips under LABELS in expanded view. |
_tag | JSON Object containing the key and values of tags appearing as purple chips under TAGS in expanded view. |
_rawline | This is usually the entire raw line. If set is displayed just above line identifiers. |
_meta | JSON Object of metadata fields and values. If _logtype is meta, these values will be displayed in a special section at the top of the expanded view. |
Line Identifier Display Names for Fields
This table shows the display name for fields as they appear in the Line Identifiers expanded view.
| Field | Line Identifiers Display Name |
|---|---|
_host | Also known as Source. Displayed as a chip in Line Identifiers, and in the color orange in the collapsed line view. |
_app | Displayed as App in Line Identifiers, and in the color blue in the collapsed line view. |
_file | File |
org | Organization |
env | Env |
dyno | Dyno |
pod | Pod |
container | Container |
namespace | Namespace |
node | Node |
containerid | Container ID |
k8sclusterkey | Cluster |
Line Metadata Display Names for Fields
This table shows the display name for fields in the Line Metadata expanded view.
| Field | Line Metadata Display Name |
|---|---|
mezmo_line_size | Line size (bytes) |
Custom Fields
Additional fields and objects will be displayed at the top of expanded view as long as _logtype is either meta or json.
Example Minimum Required JSON
{ "_line": "this is the line 1", "_ts": 1714498430000}Example of More Complex JSON
{ "_host": "mezmo", "_ingester": "Mezmo/0.34.2-custom- (x86_64-unknown-linux-gnu,debug=full)", "_label": { "app": "metallb", "component": "speaker", "controller-revision-hash": "86c95794fd", "pod-template-generation": "1" }, "_logtype": "json", "_file": "speaker", "_line": "2024-05-13T00:06:10.997763284Z stdout F {\"caller\":\"speakerlist.go:271\",\"level\":\"info\",\"msg\":\"triggering discovery\",\"customObj\": {\"SomeField\": \"Some value\" \"anotherfield\": \"a value\"}}", "_rawline": "2024-05-13T00:06:10.997763284Z stdout F {\"caller\":\"speakerlist.go:271\",\"level\":\"info\",\"msg\":\"triggering discovery\",\"customObj\": {\"SomeField\": \"Some value\" \"anotherfield\": \"a value\"}}", "_ts": 1715734305158, "_app": "speaker", "_meta": { "Image Name": "quay.io/metallb/speaker", "Tag": "v0.13.12" }, "message": "stdout F {\"caller\":\"speakerlist.go:271\",\"level\":\"info\",\"msg\":\"triggering discovery\",\"op\":\"memberDiscovery\",\"ts\":\"2024-05-13T00:06:10Z\"}", "caller": "speakerlist.go:271", "level": "info", "customObj": { "SomeField": "Some value", "anotherfield": "a value" }}