filelog receiver sets nil log body after removing body field

[rupeshnemade]

Component(s)

receiver/filelog

What happened?

Description

When we removes body from the log field with filelog receiver and renames it then the converter renders the key value as Nil.
It's expected that if the value is Nil then key should not appear at all.

Steps to Reproduce

Use filelog receiver to read logs from a file with regex parser and rules as below-
filelog/auditlog: include: - /var/log/audit/audit.log operators: - type: regex_parser regex: '^(?P<message>.*)$' - from: attributes.message to: attributes["message"] type: move - field: body type: remove

Expected Result

log field should not appear in output.

Actual Result

Getting Nil log field.

Collector version

v0.80.0

Environment information

Environment

OS: (e.g., "Ubuntu 20.04")
Compiler(if manually compiled): (e.g., "go 14.2")

OpenTelemetry Collector configuration

exporters:
  logging:
    verbosity: detailed
receivers:
  filelog/auditlog:
    include:
      - /var/log/audit/audit.log
    operators:
      - type: regex_parser
        regex: '^(?P<message>.*)$'
      - from: attributes.message
        to: attributes["message"]
        type: move
      - field: body
        type: remove
service:
  pipelines:
    logs/kernel:
      exporters:
        - logging
      processors:
        - batch
      receivers:
        - filelog/authlog

Log output

Body: Str(<nil>)
Attributes:
     -> message: Str(kubelet: E0706 11:32:21.943440    4715 kubelet_volumes.go:245] "There were many similar errors. Turn up verbosity to see them." err="orphaned pod \"0d4cf341-424f-462c-a50a-406ac8f66331\" found, but error not a directory occurred when trying to remove the volumes dir" numErrs=5)

Additional context

No response

[github-actions]

Pinging code owners:

• receiver/filelog: @djaglowski

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[djaglowski]

log field should not appear in output.

@rupeshnemade, where are you seeing this log field?

[swiatekm]

That's actually in Sumo, this is effectively the body. The problem seems to be that if the body in the stanza Entry is nil, then the Body of the Otel LogRecord is a string with the value "<nil>", as opposed to the empty string or the empty value.

I believe this is the offending line: https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/edad71083ed070e89b46bd569bb9d8d3abdc4ebd/pkg/stanza/adapter/converter.go#L305C13-L305C13

[djaglowski]

Thanks for clarifying @swiatekm-sumo. I agree with your assessment.