How transform windows application channel event logs to traces

Grafana Tempo
1

Hello ,

i’m storing .net run time logs warning and errors in windows event locally and logs format contain spanid , traceid ,

so i’m looking to convert these logs to traces , i have done used otel collector fetch logs from application channel by using :


receivers: 
  windowseventlog: 
    channel: application 
    attributes:
       type: windows

i’m stuck on processors transform phase before send them to tempo backend , with my following logs as below :


{
    "source": ".NET Runtime",
    "channel": "Application",
    "computer": "APP-2",
    "event_id": 1000,
    "level": 2,
    "levelText": "Error",
    "opCodeText": "Info",
    "keywords": "Classic",
    "timeCreated": "2024-11-29T12:06:41.419659000Z",
    "eventRecordID": 2793876,
    "event_data": "\u003cData\u003eCategory: Microsoft.AspNetCore.Server.IIS.Core.IISHttpServer\r\nEventId: 2\r\nSpanId: 7a27ca623ddbcae1\r\nTraceId: bb457e64407d36eea4ff8d9f1222cf9c\r\nParentId: 0000000000000000\r\nRequestId: 80322defd-0000-f900-b63f-844e0c7967bb\r\nRequestPath: /External/api/Transfare/appdata\r\n\r\nConnection ID \"1794234234054754549\", Request ID \"80014efd-0000-f900-b63f-84710c7967bb\": An unhandled exception was thrown by the application.\r\n\r\nException: \r\nMicrosoft.CSharp.RuntimeBinder.RuntimeBinderException: Cannot perform runtime binding on a null reference\r\n ",
    "message": "Category: Microsoft.AspNetCore.Server.IIS.Core.IISHttpServer\r\nEventId: 2\r\nSpanId: 7a27ca623ddbcae1\r\nTraceId: bb457e64407d36eea4ff8d9f1222cf9c\r\nParentId: 0000000000000000\r\nRequestId: 80322defd-0000-f900-b63f-844e0c7967bb\r\nRequestPath: /External/api/Transfare/appdata\r\n\r\nConnection ID \"1794234234054754549\", Request ID \"80014efd-0000-f900-b63f-84710c7967bb\": An unhandled exception was thrown by the application.\r\n\r\nException: \r\nMicrosoft.CSharp.RuntimeBinder.RuntimeBinderException: Cannot perform runtime binding on a null reference\r\n  "
}