From Logs to Traces: Building Traces solely based on Logfiles without instrumentation

[ca-schue]

I am currently doing a research spike for a specific problem regarding the analysis of log files: We have a distributed system with log files from different sources in different formats. Based on this, certain E2E processes are to be checked: "Was event Y triggered in subsystem X and subsystem Z called?"

My first approach, based on the ELK stack, was to convert the process into a kind of state machine diagram and check the states in Elasticqueries. However, this approach would not scale well for new processes.

Now I've come across distributed tracing with OpenTelemetry. The problem is that I have no way of instrumenting the software and integrating the TraceID into the logs. I am now thinking of mapping my processes not as state diagrams, but in traces. To do this, however, I need subsequently instrumented logs. Does anyone have experience with this or know of other approaches?

[svrnm]

This existing issue with the OpenTelemetry collector might be interesting for you: open-telemetry/opentelemetry-collector-contrib#23182

[ca-schue]

Great, thanks! This collector might be useful for my use case.