Log Model

New Log Model Specification

Attribute Type	Attribute Name	Attribute ID	Field Type	Quick Filter?	Description	Difference from Historical Model (new attributes)
Predefined	Index	index	string		The index to which the log belongs
	Occurrence time	monitorTimeUs	datetime		The occurrence time parsed from the log message, in milliseconds
	Collection time	recordTimeMs	datetime
	Ingest time	receiveTimeMs	datetime			New
	Log UID	logUid	string		Unique identifier for the log data
	traceId	traceId	string	Yes	Used to associate logs with a trace	New
	spanId	spanId	string	Yes	Used to associate logs with a span	New
	sessionId	sessionId	string	Yes	Used to associate logs with an application	New
	Log status	logStatus	string	Yes	Indicates the status of each log; defaults to unknown if not provided. In the log model, log status is a dictionary, but in the metadata it is not a dictionary
	Log message	logMessage	string		The raw log text
	Log source	logSource	string	Yes	Identifies the origin of the log; used together with traceId and deviceId for context correlation
	Log pattern	logPattern	string		Aggregated content after pattern recognition
	Log file path	logFilePath	string	Yes	Original path of the log file	New
	Normalized log path	(empty)		Yes	Normalised according to advanced settings in the log collection configuration, processed by the agent (ETL operators can support user mapping, after which normalisation is performed via rules)	New
	Related entities	releatedEntity	json		Entity type is not fixed and is data‑driven; the JSON includes entity type and entity ID. All entity‑related queries are either directly on related entities or via instance ID lookups	New
	Log agent version	logAgentVersion	string	Yes	The agent tag content, collected using the same logic as in the legacy version; only the data model has been adjusted	New
	Log agent type	logAgentType	string	Yes		New
	Device name	deviceName	string	Yes	The platform does not have a "device" concept; defining it as a predefined attribute may confuse users about the relationship between device and other information. Agent‑collected logs use the hostname as deviceName, while application‑agent logs use the application name	New
	Device ID	deviceId	number	Yes	For agent‑collected logs: machine GUID; for application‑agent logs: the terminal application deviceId. These two fields are used for log context correlation	New
	sourceHash	sourceHash	string	Yes	Unique identifier for the log file	New
	Tags (following data tags)	tag		Yes	1. The current model does not have a tag field; if needed, it must be added to the model. 2. Tags come from custom source path definitions, third‑party log ingestion, data‑flow processing, ETL processing (manual conditions), etc. When written, they are stored as data tags and displayed on the UI
	Data centre	dataCentrtId	string	Yes	Treated as a fixed parsing attribute. In ETL data flows and processing, it is displayed as a fixed parsing attribute configuration and cannot be modified – to ensure backward compatibility. For data centre values: for agent‑collected or third‑party logs, the data centre is selected at deployment or ingestion time. Whether defined as a predefined or parsed attribute is acceptable because both are pre‑defined in the model
Entity attributes	Service name	entity,service.customizedName	text
	Service instance name	entity,serviceinstance.customizedName	text
	Process name	entity.process,customizedName	text
	Container name	entity.container.customizedName	text
	Pod name	entity.k8spod.customizedName	text
	Application name	entity.app.customizedName	text
	Host name	entity.host.customizedName	text
	Kubernetes cluster name	entity.k8scluster.customizedName	text
	Kubernetes node name	entity.k8snode.customizedName	text
	Kubernetes namespace name	entity.k8snamespace.customizedName	text
	Kubernetes workload name	entity.k8sworkload.customizedName	text
	Kubernetes service name	entity.k8sservice.customizedName	text

---

Field Descriptions

• Attribute Type:

  • Predefined attributes: Fixed log properties that represent basic log information and exist for all log data.
  • Tags: Differs from the legacy log tag concept – agent‑reported tags are no longer retained; useful information is extracted into predefined tags. In the new model, tags are data labels for display purposes. They originate from tags added during custom source path definition, selected in data flows, applied during ETL ingestion, or from OTel protocol ingestion.
  • Parsed attributes: Dynamic metadata attributes registered through data processing, annotation mapping, or ETL ingestion. Not all parsed attributes are displayed in the quick‑filter list.
  • Entity attributes: Attributes from the metadata entity model, covering a fixed set of entity types.

• Attribute Name: The name of the attribute field.

• Field Type:

  • Predefined attributes have fixed types; parsed attributes are automatically identified as text or numeric types at creation time.

• Quick Filter:

  • The log model includes both predefined and parsed attributes, but not all are shown in the log query filter bar or referenced by other services.
  • This flag indicates whether the attribute should be exposed for user use.
  • Attributes marked as quick‑filter are available in the log query page configuration.