From 1964b76d782fee9b62b73259fc18f0d7b6d5bf1c Mon Sep 17 00:00:00 2001
From: Lency Qian <leqia@microsoft.com>
Date: Thu, 7 Aug 2025 14:16:05 +0800
Subject: [PATCH 1/2] otel logging

---
 .../symphony/files/otel-forwarder-config.yaml | 39 +++++++++++++++++++
 .../symphony-core/symphony-otelforwarder.yaml |  4 +-
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/packages/helm/symphony/files/otel-forwarder-config.yaml b/packages/helm/symphony/files/otel-forwarder-config.yaml
index 9a713bc61..c5fff05c2 100644
--- a/packages/helm/symphony/files/otel-forwarder-config.yaml
+++ b/packages/helm/symphony/files/otel-forwarder-config.yaml
@@ -91,6 +91,10 @@ receivers:
         if: 'body["caller"] != nil'
         from: body["caller"]
         to: attributes["caller"]
+      - type: move
+        if: 'body["instance"] != nil'
+        from: body["instance"]
+        to: attributes["instance"]
       - type: move
         if: 'body["level"] != nil'
         from: body["level"]
@@ -262,6 +266,29 @@ processors:
     # 25% of limit up to 2G
     spike_limit_mib: 512
     check_interval: 5s
+  
+  filter/userAudits:
+    logs:
+      log_record:
+        - 'not IsMatch(attributes["log"], "^.*activity.*$")'
+        #- attributes["type"] == nil or attributes["type"] != "userAudits"
+  filter/userDiagnostics:
+    logs:
+      log_record:
+        - 'not IsMatch(attributes["log"], "^.*diagnostics.*$")'
+        #- attributes["type"] == nil or attributes["type"] != "userDiagnostics
+  transform/userAudits:
+    error_mode: ignore
+    log_statements:
+      - context: log
+        statements:
+          - set(instrumentation_scope.name, "userAudits")
+  transform/userDiagnostics:
+    error_mode: ignore
+    log_statements:
+      - context: log
+        statements:
+          - set(instrumentation_scope.name, "userDiagnostics")
 
 exporters:
   otlp/default:
@@ -283,4 +310,16 @@ service:
       receivers: [filelog]
       processors: [memory_limiter, batch, k8sattributes, resource/rename]
       exporters: [otlp/default]
+      # exporters: [debug]
+    
+    logs/userAudits:
+      receivers: [otlp]
+      processors: [memory_limiter, batch, filter/userAudits, transform/userAudits]
+      exporters: [otlp/userAudits]
+      # exporters: [debug]
+
+    logs/userDiagnostics:
+      receivers: [otlp]
+      processors: [memory_limiter, batch, filter/userDiagnostics, transform/userDiagnostics]
+      exporters: [otlp/userDiagnostics]
       # exporters: [debug]
\ No newline at end of file
diff --git a/packages/helm/symphony/templates/symphony-core/symphony-otelforwarder.yaml b/packages/helm/symphony/templates/symphony-core/symphony-otelforwarder.yaml
index c8d8998df..91a705ad7 100644
--- a/packages/helm/symphony/templates/symphony-core/symphony-otelforwarder.yaml
+++ b/packages/helm/symphony/templates/symphony-core/symphony-otelforwarder.yaml
@@ -24,6 +24,8 @@ spec:
     metadata:
       labels:
         app: {{ include "symphony.appSelector" . }}-otel-forwarder
+      annotations:
+        checksum/config: {{ tpl (.Files.Get "files/otel-forwarder-config.yaml") . | sha256sum }}
     spec:
       # read prometheus metrics from manager and exports to mdm
       containers:
@@ -109,4 +111,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "symphony.fullname" . }}-otel-forwarder-clusterrole
   apiGroup: rbac.authorization.k8s.io
-{{- end }}
\ No newline at end of file
+{{- end }}

From 10a213662ed1cf6fba03477fffa186e7622dff43 Mon Sep 17 00:00:00 2001
From: Lency Qian <leqia@microsoft.com>
Date: Thu, 7 Aug 2025 14:18:33 +0800
Subject: [PATCH 2/2] update filter

---
 packages/helm/symphony/files/otel-forwarder-config.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/helm/symphony/files/otel-forwarder-config.yaml b/packages/helm/symphony/files/otel-forwarder-config.yaml
index c5fff05c2..3a9c21769 100644
--- a/packages/helm/symphony/files/otel-forwarder-config.yaml
+++ b/packages/helm/symphony/files/otel-forwarder-config.yaml
@@ -270,13 +270,13 @@ processors:
   filter/userAudits:
     logs:
       log_record:
-        - 'not IsMatch(attributes["log"], "^.*activity.*$")'
-        #- attributes["type"] == nil or attributes["type"] != "userAudits"
+        #- 'not IsMatch(attributes["log"], "^.*activity.*$")'
+        - attributes["type"] == nil or attributes["type"] != "userAudits"
   filter/userDiagnostics:
     logs:
       log_record:
-        - 'not IsMatch(attributes["log"], "^.*diagnostics.*$")'
-        #- attributes["type"] == nil or attributes["type"] != "userDiagnostics
+        #- 'not IsMatch(attributes["log"], "^.*diagnostics.*$")'
+        - attributes["type"] == nil or attributes["type"] != "userDiagnostics
   transform/userAudits:
     error_mode: ignore
     log_statements: