-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Description
Component(s)
exporter/awskinesis
Describe the issue you're reporting
Description
The AWS Kinesis exporter does not include a time field at the root level of the exported JSON logs. When logs are sent to OpenSearch via the AWS Kinesis exporter, the timestamp field is nested within the log structure instead of being at the root level. This causes Kibana to be unable to display the logs, as Kibana requires a root-level timestamp field (such as @timestamp or timestamp) to properly render and filter logs in its UI.
Steps to Reproduce
- Configure the OpenTelemetry Collector with the AWS Kinesis exporter to send logs to OpenSearch
- Configure the exporter to send logs through Kinesis to OpenSearch
- Send log data through the collector pipeline
- Verify that logs are successfully delivered to OpenSearch and indexed
- Query the logs directly via OpenSearch CLI to confirm they exist
- Open Kibana and attempt to view the logs in the Discover view
Expected Result
- Logs should be visible and filterable in Kibana's UI
- Kibana should be able to use the root-level timestamp field to display logs chronologically
- All log entries should appear in the Kibana Discover view with proper time-based filtering
Actual Result
- Logs are successfully sent to OpenSearch
- Logs are correctly indexed in OpenSearch
- Logs can be queried via OpenSearch CLI
- Logs do NOT appear in Kibana's UI
- Kibana cannot display the logs because the timestamp field is nested rather than at the root level of the JSON structure
Environment:
- Collector version: 0.135.0
- AWS Kinesis exporter configuration:
awskinesis:
aws:
stream_name: example name
region: eu-west-1
role: arn:aws:iam::example:role/example
encoding:
name: otlp_jsonProposed Solution:
Add a configuration flag to the AWS Kinesis exporter that allows users to specify a nested timestamp field path to be promoted to the root level of the exported JSON.
Tip
React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.