Why does the collector add en event to a logmessage

[zellen]

Discussed in https://github.com/signalfx/splunk-otel-collector-chart/discussions/1126

^{Originally posted by **zellen** January 23, 2024} We have an application that runs in an app service in Azure and uses Serilog.Sinks.Splunk to send logs directly to the HEC endpoint of Splunk. Then in our backend, which runs in an AKS-cluster, we use the Splunk Otel Collector to collect our logs and send it to the same HEC endpoint as the app service above. Both are using the same formatter, SplunkJsonFormatter Logs that are sent directly from the app service looks like this:  And logs coming from the cluster looks like this where the event is wrapped inside an event:  I want both logs to look the same without our backend logs being wrapped in an extra event.

[github-actions[bot]]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. If this issue is still relevant, please leave a comment explaining why it is still relevant. Otherwise, please close it.

[atoulme]

Please open a support case for further help.