Add Logs to OpenTelemetry vocabulary

[tigrannajaryan]

This commit proposes the initial vocabulary for logs and event to be used across
OpenTelemetry project.

This is an initial proposal and we can extend / clarify the vocabulary as we go.

[arminru]

It's great that you take care of having consistent and well-defined terms right from the start! 👍

[arminru]

I'd also expect "log attributes" to be metadata about a whole log file/stream (e.g. producer, host or service information, time span, size) rather than attributes on a single log record/entry.

[jaredcnance]

I think there are two classes of data which can be included in structured logs:

• attributes: key/value pairs that are specific to a single log record and often have high cardinality values (e.g. timestamp)
• metadata: key/value pairs that apply to one or more log records, generally constant for a given span (e.g. traceId, customerId, etc.) or may be constant for the lifetime of the process (e.g. host, containerId, etc.).

[tigrannajaryan]

I agree with the distinction.

The constants part of "metadata" is stored in a Resource in OpenTelemetry. There is already a definition of a Resource.

The non-const parts are Attributes of a log record. The fact that they can be identical for a batch of log records is a data modeling topic and does not belong to the vocabulary (at least not yet, until we have the data model). We can have further clarification of types of attributes, but for now I would refrain from adding anything to the vocabulary. It is best to discuss this in a Data Model proposal (which I believe we inevitably need to have).

(BTW, "metadata" is not a well defined term, IMO it is best to avoid using it in this discussion since people have different understanding of what metadata means).

[arminru]

I agree with both of your comments.
My comment was about the term "log attributes" itself, which sounds like attributes that apply to the whole log file/stream (collection of logs) at once. These could therefore, for example, be expressed and stored in a Resource or preamble to a log file/stream rather than one single log record. I'd rather call the key/value pairs contained in a single log record "log record attributes" to avoid this ambiguity.

[mtwo]

Thanks for doing this, I approve modulo some of the changes that @arminru has requested

[tigrannajaryan]

I also added Log with a recommendation not to use it without additional qualifiers to avoid confusion.