Docs » Supported integrations in Splunk Observability Cloud » Instrument back-end applications to send spans to Splunk APM » Instrument .NET applications for Splunk Observability Cloud (OpenTelemetry) » Connect .NET trace data with logs using OpenTelemetry instrumentation

Connect .NET trace data with logs using OpenTelemetry instrumentation 🔗

The Splunk Distribution of OpenTelemetry .NET automatically exports logs enriched with tracing context from any application that uses logging API from:

Application logs are enriched with tracing metadata and then exported to a local instance of the OpenTelemetry Collector in OTLP format.

The following is an example of logs produced by a sample console application:

2024-02-15 15:23:17 2024-02-15T13:23:17.704Z    info    ResourceLog #0
2024-02-15 15:23:17 Resource SchemaURL:
2024-02-15 15:23:17 Resource attributes:
2024-02-15 15:23:17      -> splunk.distro.version: Str(1.4.0)
2024-02-15 15:23:17      -> container.id: Str(c894cdb646a29616b5f713195cf810be898ca99c311cac8d9d25d8561dd6964b)
2024-02-15 15:23:17      -> telemetry.distro.name: Str(splunk-otel-dotnet)
2024-02-15 15:23:17      -> telemetry.distro.version: Str(1.4.0)
2024-02-15 15:23:17      -> telemetry.sdk.name: Str(opentelemetry)
2024-02-15 15:23:17      -> telemetry.sdk.language: Str(dotnet)
2024-02-15 15:23:17      -> telemetry.sdk.version: Str(1.7.0)
2024-02-15 15:23:17      -> service.name: Str(Example.LogTraceCorrelation.Console)
2024-02-15 15:23:17      -> deployment.environment: Str(dev)
2024-02-15 15:23:17      -> service.version: Str(1.0.0)
2024-02-15 15:23:17 ScopeLogs #0
2024-02-15 15:23:17 ScopeLogs SchemaURL:
2024-02-15 15:23:17 InstrumentationScope
2024-02-15 15:23:17 LogRecord #0
2024-02-15 15:23:17 ObservedTimestamp: 2024-02-15 13:23:13.1358363 +0000 UTC
2024-02-15 15:23:17 Timestamp: 2024-02-15 13:23:13.1358363 +0000 UTC
2024-02-15 15:23:17 SeverityText: Information
2024-02-15 15:23:17 SeverityNumber: Info(9)
2024-02-15 15:23:17 Body: Str(Hello from {activity})
2024-02-15 15:23:17 Attributes:
2024-02-15 15:23:17      -> activity: Str(LogWrappingActivity)
2024-02-15 15:23:17 Trace ID: 17512c0247942df04fb30e6090eacb2c
2024-02-15 15:23:17 Span ID: dc281b062178e72f
2024-02-15 15:23:17 Flags: 1

Check compatibility and requirements 🔗

Note

Automatic log to trace correlation for Microsoft.Extensions.Logging only works for .NET applications. For .NET Framework use manual correlation. See Manual log to trace correlation.

The following applies:

  • Microsoft.Extensions.Logging version 9.0.0 and higher are supported

  • log4net version from 2.0.13 to 4.0.0 are supported

  • The environmental variable OTEL_DOTNET_AUTO_LOGS_ENABLE_LOG4NET_BRIDGE needs to be set to true

Activate log correlation 🔗

The instrumentation turns on automatic log to trace correlation by default.

If you need to turn off logs enrichment and export, set the value of OTEL_DOTNET_AUTO_LOGS_ENABLED environment variable to false.

Trace metadata in log statements 🔗

Individual log records, if exported inside the scope of an active activity, contain the following trace context information:

  • Trace identifier

  • Span identifier

  • Trace flags

Logs produced by an application always have the following set of OpenTelemetry resource attributes :

  • telemetry.sdk.name with constant value of opentelemetry

  • telemetry.sdk.language with constant value of dotnet

  • telemetry.sdk.version with current version of OpenTelemetry .NET SDK

  • telemetry.distro.name with constant value of splunk-otel-dotnet

  • telemetry.distro.version with current version of Splunk Distribution of OpenTelemetry .NET

  • splunk.distro.version with current version of Splunk Distribution of OpenTelemetry .NET (deprecated attribute)

Additionally, the instrumentation adds the following attributes:

  • service.name, as defined by the OTEL_SERVICE_NAME environment variable

  • Any attribute configured using the OTEL_RESOURCE_ATTRIBUTES environment variable

  • Any attribute added by configured resource detectors, like container.id

Manual log to trace correlation 🔗

You can configure logging libraries to include tracing attributes in logs written to existing log destinations.

log4net 🔗

You can modify conversionPattern in your log4net appender to include tracing attributes in logs written to existing log destinations.

The following properties are set by default for the collection of logging events:

  • trace_id

  • span_id

  • trace_flags

Example on how to configure ConsoleAppender:

<appender name="ConsoleAppender" type="log4net.Appender.ConsoleAppender">
   <layout type="log4net.Layout.PatternLayout">
      <conversionPattern value="%date [%thread] %-5level %logger - %message span_id=%property{span_id} trace_id=%property{trace_id} trace_flags=%property{trace_flags} test_key=%property{test_key}%newline" />
   </layout>
</appender>

NLog 🔗

You can use NLog.DiagnosticSource . See the NLog official documentation for more information.

Serilog 🔗

You can use one of the available enrichers, like Serilog.Enrichers.Span or create your own enricher to add trace context as properties to log events.

This page was last updated on Feb 10, 2025.