Skip to content

Conversation

@zmoog
Copy link
Contributor

@zmoog zmoog commented Dec 10, 2025

Description

Includes support for all the remaining seven Activity log categories:

  • Administrative
  • Alert
  • Autoscale
  • Policy
  • Resource Health
  • Security
  • Service Health

The PR is built on top of the PR #43220 that added support for the Recommendation log category.

It applies the same philosophy:

  • Capture the recurring data structures as much as possible (e.g., Identity).
  • Map a field when it's definitely useful; don't map a field if in doubt—we can still add it later.

Note for reviewers: I'm not 100% on the field naming convention, so your feedback and insight are really needed here.

Link to tracking issue

N/A

Testing

I collected some sample logs from actual Azure and anonymized a little bit for the following log categories:

  • Administrative
  • Policy
  • ResourceHealth
  • ServiceHealth

However, I wasn't able to get actual log events for the following categories, so I inferred them from samples available in the Azure docs (which seems to use the Log Analytics Workspace format):

  • Alert
  • Autoscale
  • Security

Please pay extra attention when reviewing these categories, and please let me know if you're able to share some actual samples from Azure.

Documentation

N/A

Includes support for:

- Administrative
- Alert
- Autoscale
- Policy
- Resource Health
- Security
- Service Health
@zmoog zmoog force-pushed the zmoog/pkg/translator/azurelogs/activitylogs-complete branch from e84b5d8 to f452454 Compare December 10, 2025 10:29
@zmoog zmoog marked this pull request as ready for review December 10, 2025 10:29
@zmoog zmoog requested review from a team and atoulme as code owners December 10, 2025 10:29
| `properties.category` | `azure.servicehealth.impact.category` |
| `properties.defaultLanguageTitle` | `azure.servicehealth.default_language.title` |
| `properties.defaultLanguageContent` | `azure.servicehealth.default_language.content` |
| `properties.stage` | `azure.servicehealth.stage` |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could this be described as a state?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The semantics of this field is not 100% clear yet, but "state" seems to fit. Do you think it's worth diverging from the field name?

@zmoog
Copy link
Contributor Author

zmoog commented Dec 10, 2025

Hey @thompson-tomo, thank you for kicking off the review! All the suggestions I see make sense. What are the best resources to get started with naming conventions in semconv, so I can avoid making n00b choices?

Co-authored-by: James Thompson <thompson.tomo@outlook.com>
@thompson-tomo
Copy link
Contributor

thompson-tomo commented Dec 10, 2025

No worries at all. A good place to start would be https://opentelemetry.io/docs/specs/semconv/general/naming/ & https://opentelemetry.io/docs/specs/semconv/how-to-write-conventions/ there are tasks to improve those docs. Also a good understanding can be gained by reviewing what is already defined.

The way I like to think during attribute naming is what is the item that is being described. That becomes the 2nd last namespace with the last being a property of the item you are capturing.

| `properties.service` | `azure.servicehealth.service` |
| `properties.region` | `azure.servicehealth.region` |
| `properties.communication.communicationId` | `azure.servicehealth.communication.id` |
| `properties.communication.communicationBody` | `azure.servicehealth.communication.text` |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about just properties.communication?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Uhm, we have azure.servicehealth.communication.id so I was considering moving the actual communication text under azure.servicehealth.communication.*: do you think this makes sense?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that make sense! But I was looking at the sample log, I thought I see field from the sample log is just properties.communication instead of properties.communication.communicationBody?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For me azure.servicehealth.communication.body would be the best attribute naming. Note in semantic conventions complex attributes ie objects are discouraged hence preferred to create individual attributes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

azure.servicehealth.communication.body LGTM!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants