Logs Remap

Every ingestion agent describes the same log event differently. Datadog sends the message text in message and names the emitting application in ddsource; GCP puts the text in textPayload, OTLP in body. Remap is the normalization stage in the Kloudfuse ingester that reads each agent’s raw payload and populates one common representation: a small set of standard fields, plus the labels used for filtering and grouping.

The Logs Remap page under the Admin tab is the editor for that normalization. It shows you a live sample from an agent, the rules currently applied to it, and the normalized result the engine produces — side by side, so you can confirm a mapping before it goes live.

The engine already ships with built-in extraction for each supported agent. You only use this page when the defaults do not cover your payload: a custom shipper that puts the message somewhere unusual, an application field you want promoted to a label, or a non-standard timestamp format.