Configure custom log transformations in groundcover using OpenTelemetry Transformation Language (OTTL). Tailor your logs with structured pipelines for parsing, filtering, and enriching data before ing
Last updated
groundcover supports the configuration of log pipelines using OpenTelemetry Transformation Language (OTTL) to process and customize your logs. With OTTL, you gain full flexibility to transform data as it flows into the platform.
groundcover uses OTTL to enrich and shape log data inside your monitored environments. OTTL pipelines give you a structured way to parse, filter, and modify logs before ingestion.
Each pipeline is made up of transformation steps—each step defines a specific operation (like parsing JSON, extracting key-value pairs, or modifying attributes). You can configure these transformations directly in your groundcover deployment.
To test your logic before going live, we recommend using our Parsing Playground (click the top right corner when viewing a specific log).
To define an OTTL pipeline, make sure to include the following fields:
statements – List of transformations to apply.
conditions – Logic for when the rule should trigger.
errorMode – How to handle errors (e.g., skip, fail).
logicOperator – Used when you define multiple conditions.
Transformations are automatically appended to the default pipeline, so there’s no need to replace anything. Just define your rules, add them to your values file, redeploy, and you’re done.
Each rule must have a unique ruleName.
Use conditions to apply transformations only when specific attributes match. This ensures your pipeline runs efficiently and only on relevant logs.
Common fields you can use:
workload – Name of the service or app.
container_name – Container where the log originated.
level – Log severity (e.g., info, error).
format – Log format (e.g., JSON, CLF, unknown).
Some commonly used functions in groundcover:
ExtractGrokPatterns
ParseJSON
Replace_pattern
Delete_key
ToLowerCase
Concat
ParseKeyValue
