[pkg/ottl] Create an ottl function that that will take a log record with slice bodies and expand each element of the slice into its own log record

[rnishtala-sumo]

Component(s)

pkg/ottl

Is your feature request related to a problem? Please describe.

There currently isn't a way to split a log record body containing a slice into multiple log records. The closest to this is the following experimental processor - https://github.com/observIQ/bindplane-otel-collector/tree/main/processor/unrollprocessor

As suggested in the above processor, this seems like a good candidate for an ottl function.

Describe the solution you'd like

Create an ottl function that that will take a log record with slice bodies and expand each element of the slice into its own log record

For example a log body having the following data 1,2,3 could be split into multiple log records like below

{
  "resourceLogs": [
    {
      "resource": {},
      "scopeLogs": [
        {
          "scope": {},
          "logRecords": [
            {
              "observedTimeUnixNano": "1733240156591852000",
              "body": { "stringValue": "1" },
              "attributes": [
                {
                  "key": "log.file.name",
                  "value": { "stringValue": "test.txt" }
                },
              ],
              "traceId": "",
              "spanId": ""
            },
            {
              "observedTimeUnixNano": "1733240156591852000",
              "body": { "stringValue": "2" },
              "attributes": [
                {
                  "key": "log.file.name",
                  "value": { "stringValue": "test.txt" }
                },
              ],
              "traceId": "",
              "spanId": ""
            },
            {
              "observedTimeUnixNano": "1733240156591852000",
              "body": { "stringValue": "3" },
              "attributes": [
                {
                  "key": "log.file.name",
                  "value": { "stringValue": "test.txt" }
                },
              ],
              "traceId": "",
              "spanId": ""
            }
          ]
        }
      ]
    }
  ]
}

Describe alternatives you've considered

An alternative is the following experimental processor in a distribution of otel

https://github.com/observIQ/bindplane-otel-collector/tree/main/processor/unrollprocessor

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[github-actions]

Pinging code owners:

• pkg/ottl: @TylerHelmuth @evan-bradley @edmocosta

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[axw]

Presumably this would be used in the transform processor. How would the transform processor behave if there were statements following this new function? Would they apply to all of the newly split log records? What happens to the log.cache (see https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/pkg/ottl/contexts/ottllog/README.md#paths)?

I'm not aware of any existing OTTL functions that add new items to a batch. It seems like something that should exist, but it's unclear to me whether this an easily be added to the transform processor. Tagging processor/transform code owners for input.

[github-actions]

Pinging code owners for processor/transform: @TylerHelmuth @evan-bradley @edmocosta. See Adding Labels via Comments if you do not have permissions to add labels yourself. For example, comment '/label priority:p2 -needs-triaged' to set the priority and remove the needs-triaged label.