Skip to navigation
Archive & RestoreTelemetry Data

Required Schema for Mezmo Log Analysis Destination

If you choose to restore data to the Mezmo Log Analysis Destination, it must conform to the schema shown in this topic.

This schema is what appears in the message property within the Pipeline. The contents of message is what is sent to the archive.

Primary Fields

Field NameDescription
_line(required) This is the content of the log line to be displayed in the collapsed line viewer.
_ts(required) The epoch timestamp.
_logtypeHelps lineviewer decide which renderer to use when line is expanded. \n\n\n\n Valid values are customapp, json, meta, combinedapachelog, commonapachelog, github, mongo3log, redis3log, heroku_line, heroku_router
levelIndicates the level of severity and it displayed in the collapsed line.
_labelJSON Object containing the key and values of labels appearing as yellow chips under LABELS in expanded view.
_tagJSON Object containing the key and values of tags appearing as purple chips under TAGS in expanded view.
_rawlineThis is usually the entire raw line. If set is displayed just above line identifiers.
_metaJSON Object of metadata fields and values. If _logtype is meta, these values will be displayed in a special section at the top of the expanded view.

Line Identifier Display Names for Fields

This table shows the display name for fields as they appear in the Line Identifiers expanded view.

FieldLine Identifiers Display Name
_hostAlso known as Source. Displayed as a chip in Line Identifiers, and in the color orange in the collapsed line view.
_appDisplayed as App in Line Identifiers, and in the color blue in the collapsed line view.
_fileFile
orgOrganization
envEnv
dynoDyno
podPod
containerContainer
namespaceNamespace
nodeNode
containeridContainer ID
k8sclusterkeyCluster

Line Metadata Display Names for Fields

This table shows the display name for fields in the Line Metadata expanded view.

FieldLine Metadata Display Name
mezmo_line_sizeLine size (bytes)

Custom Fields

Additional fields and objects will be displayed at the top of expanded view as long as _logtype is either meta or json.

Example Minimum Required JSON

{
    "_line": "this is the line 1", 
    "_ts": 1714498430000
}

Example of More Complex JSON

{
    "_host": "mezmo",
    "_ingester": "Mezmo/0.34.2-custom- (x86_64-unknown-linux-gnu,debug=full)",
    "_label": {
        "app": "metallb",
        "component": "speaker",
        "controller-revision-hash": "86c95794fd",
        "pod-template-generation": "1"
    },
    "_logtype": "json",
    "_file": "speaker",
    "_line": "2024-05-13T00:06:10.997763284Z stdout F {\"caller\":\"speakerlist.go:271\",\"level\":\"info\",\"msg\":\"triggering discovery\",\"customObj\": {\"SomeField\": \"Some value\" \"anotherfield\": \"a value\"}}",
    "_rawline": "2024-05-13T00:06:10.997763284Z stdout F {\"caller\":\"speakerlist.go:271\",\"level\":\"info\",\"msg\":\"triggering discovery\",\"customObj\": {\"SomeField\": \"Some value\" \"anotherfield\": \"a value\"}}",
    "_ts": 1715734305158,
    "_app": "speaker",
    "_meta": {
        "Image Name": "quay.io/metallb/speaker",
        "Tag": "v0.13.12"
    },
    "message": "stdout F {\"caller\":\"speakerlist.go:271\",\"level\":\"info\",\"msg\":\"triggering discovery\",\"op\":\"memberDiscovery\",\"ts\":\"2024-05-13T00:06:10Z\"}",
    "caller": "speakerlist.go:271",
    "level": "info",
    "customObj": {
        "SomeField": "Some value",
        "anotherfield": "a value"
    }
}