In the current project, I send application logs to Splunk, while the splunk-otel-collector is responsible for sending instrumentation logs to SignalFx. The problem is we use the CloudFrontID as a correlationID to filter logs in Splunk, whereas SignalFx generates and uses the TraceId for logging. I am currently facing challenges in correlating the application logs' correlationID with SignalFx's TraceId.
I tried to log the TraceId value in application logs using the "Serilog.Enrichers.Span" NuGet package. However, no values were logged in Splunk.
var loggerConfig =
new LoggerConfiguration().MinimumLevel.ControlledBy(LogLevel)
.Destructure.UsingAttributes()
.Enrich.WithSpan(new SpanOptions
{
IncludeTraceFlags = true,
LogEventPropertiesNames = new SpanLogEventPropertiesNames()
{
ParentId = "ParentId1",
SpanId = "SpanId1",
TraceId = "TraceId1",
OperationName = "OperationName1"
},
IncludeBaggage = true,
IncludeOperationName = true,
IncludeTags = true,
})
.Enrich.FromLogContext();
How can I access the TraceId generated by the splunk-otel-collector within the ASP.NET web application (Framework version: 4.7.2)?
To inject trace context fields in logs, enable log correlation by setting the SIGNALFX_LOGS_INJECTION environment variable to true before running your instrumented application.
Reference: https://github.com/signalfx/signalfx-dotnet-tracing/blob/main/docs/correlating-traces-with-logs.md
After enabling this environment variable: SIGNALFX_LOGS_INJECTION, I was able to see the traceId values in Splunk.