Detected fields in logs

I have logs that have the traceID and spanID in the message as shown below:

2021-12-16 21:29:47 [traceID=b2a7700abcd810cd3ccd12573da1d4b9 spanID=3b975dfdc87bc2cc] Received Order with ID :12348e 

I see that the traceID and spanID are automatically parsed out as Detected fields. I dont have any configuration on the datasource. But the preceding “[” character becomes a part of the traceID field and the trailing one becomes a part of the value of spanID. Is this expected ? And if not, how do I fix it ? I added the correct pattern as a new field (?:traceID)=(\w+). That does extract the correct value but the [traceID field also still shows up with it.

I think this happens with anything that resembles logfmt or json. Grafana makes a guess and “detects” fields for you even though no parser has been applied. I definitely could be wrong about this though.

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.