Datadog Logs Log Attributes Structure

{
  "$schema": "https://json-structure.org/meta/core/v0/#",
  "$id": "https://raw.githubusercontent.com/api-evangelist/datadog/refs/heads/main/json-structure/datadog-logs-log-attributes-structure.json",
  "name": "LogAttributes",
  "description": "The attributes of a log event returned from the search API",
  "type": "object",
  "properties": {
    "timestamp": {
      "type": "datetime",
      "description": "ISO 8601 timestamp when the log was generated",
      "example": "2026-04-17T12:00:00Z"
    },
    "status": {
      "type": "string",
      "description": "The log level or severity status of the event",
      "example": "OK"
    },
    "message": {
      "type": "string",
      "description": "The raw log message content",
      "example": "CPU usage is high on {{host.name}}"
    },
    "host": {
      "type": "string",
      "description": "The hostname of the machine that generated the log",
      "example": "example_value"
    },
    "service": {
      "type": "string",
      "description": "The name of the application or service that generated the log",
      "example": "example_value"
    },
    "source": {
      "type": "string",
      "description": "The technology source that generated the log (e.g., nginx, java)",
      "example": "example_value"
    },
    "tags": {
      "type": "array",
      "description": "List of tags associated with the log event in key:value format",
      "items": {
        "type": "string"
      }
    },
    "attributes": {
      "type": "object",
      "description": "Custom key-value attributes extracted from the log message",
      "additionalProperties": true
    }
  }
}