Will OpenTelemetry SDK enriched logs + Coroot node-agent cause duplicate logs?

[zanozbot]

Hey,

We use:

• .NET services with OpenTelemetry SDK
• Coroot node-agent in Kubernetes scraping container logs

We're looking at sending enriched logs from our services with additional context using OpenTelemetry SDK directly to Coroot, but we're wondering how duplicate logs are handled if the same logs are:

• scraped by coroot-node-agent from stdout, and
• exported directly via OTLP.

Does this lead to duplicates in Coroot, or is there deduplication?

I've found an environmental variable with which I could disable the log monitoring for a specific container COROOT_LOG_MONITORING=disabled but this concerns me a bit about the resilience. If a service starts failing and OTLP log export is impacted, we could lose logs we'd otherwise still get from the node-agent scraping.

How is this typically handled or recommended in Coroot?

---

Should we switch over to logging in a structured format like logfmt or JSON? Is Coroot smart enough so that context fields become serachable?

[def]

Usually, when you configure the OTel SDK to export logs to a backend, it doesn’t duplicate them to stdout/stderr. In a typical setup, your app sends logs to Coroot via the OTel SDK, and if there are any delivery issues with the collector, the SDK logs errors to stdout/stderr using standard logging mechanisms. Those logs are then captured by coroot-node-agent.

[zanozbot]

Thanks @def for your answer. How do I achieve so that Coorot automatically links logs and traces without me needed to manually do that?