Connect trace data with logs

Learn how OBI enriches application logs with trace context to correlate logs and distributed traces.

Overview

OBI correlates application logs with distributed traces by enriching JSON logs with trace context. This allows you to link logs to the traces they originated from, enabling deeper analysis and faster troubleshooting.

OBI does not export logs. Instead, it writes enriched logs back to the same stream, while traces are exported through OTLP to a Collector or endpoint.

For more information about trace and log correlation behavior, see the OpenTelemetry trace–log correlation documentation.

How log enrichment works

OBI uses eBPF to inject trace context into application logs at the kernel level:

  1. Trace capturing: OBI captures trace context (trace ID and span ID) for all traced operations
  2. Log interception: OBI intercepts write syscalls to capture application logs
  3. Context injection: For JSON-formatted logs, OBI injects trace_id and span_id fields
  4. Trace export: Logs keep flowing through your existing logging pipeline
  5. Backend linking: Your observability backend links logs to traces using these IDs

Learn more about requirements to enable log correlation.