introducing: log.type

.chloggen/log.type.yaml

@@ -0,0 +1,22 @@
+# Use this changelog template to create an entry for release notes.
+#
+# If your change doesn't affect end users you should instead start
+# your pull request title with [chore] or use the "Skip Changelog" label.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the area of concern in the attributes-registry, (e.g. http, cloud, db)
+component: log
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: "Introduce `log.type` attribute to classify log entries by type."
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+# The values here must be integers.
+issues: [ 3429 ]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

docs/general/logs.md

@@ -43,12 +43,22 @@ These attributes may be used for identifying a Log Record.
 | --- | --- | --- | --- | --- | --- |
 | [`log.record.original`](/docs/registry/attributes/log.md) | ![Development](https://img.shields.io/badge/-development-blue) | `Opt-In` | string | The complete original Log Record. [1] | `77 <86>1 2015-08-06T21:58:59.694Z 192.168.2.133 inactive - - - Something happened`; `[INFO] 8/3/24 12:34:56 Something happened` |
 | [`log.record.uid`](/docs/registry/attributes/log.md) | ![Development](https://img.shields.io/badge/-development-blue) | `Opt-In` | string | A unique identifier for the Log Record. [2] | `01ARZ3NDEKTSV4RRFFQ69G5FAV` |
+| [`log.type`](/docs/registry/attributes/log.md) | ![Development](https://img.shields.io/badge/-development-blue) | `Opt-In` | string | The type or category of the log record. See below for a list of well-known values. | `audit`; `app` |
 
 **[1] `log.record.original`:** This value MAY be added when processing a Log Record which was originally transmitted as a string or equivalent data type AND the Body field of the Log Record does not contain the same value. (e.g. a syslog or a log record read from a file.)
 
 **[2] `log.record.uid`:** If an id is provided, other log records with the same id will be considered duplicates and can be removed safely. This means, that two distinguishable log records MUST have different values.
 The id MAY be an [Universally Unique Lexicographically Sortable Identifier (ULID)](https://github.com/ulid/spec), but other identifiers (e.g. UUID) may be used as needed.
 
+---
+
+`log.type` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
+
+| Value | Description | Stability |
+| --- | --- | --- |
+| `app` | Default regular application log - everything which is NOT audit relevant | ![Development](https://img.shields.io/badge/-development-blue) |
+| `audit` | Audit log recording security-relevant activities for compliance and forensics. When log.type='audit', the log record SHOULD not get lost and body not changed. | ![Development](https://img.shields.io/badge/-development-blue) |
+
 <!-- prettier-ignore-end -->
 <!-- END AUTOGENERATED TEXT -->
 <!-- endsemconv -->

docs/registry/attributes/log.md

@@ -16,6 +16,7 @@ This document defines log attributes
 | Key | Stability | Value Type | Description | Example Values |
 | --- | --- | --- | --- | --- |
 | <a id="log-iostream" href="#log-iostream">`log.iostream`</a> | ![Development](https://img.shields.io/badge/-development-blue) | string | The stream associated with the log. See below for a list of well-known values. | `stdout`; `stderr` |
+| <a id="log-type" href="#log-type">`log.type`</a> | ![Development](https://img.shields.io/badge/-development-blue) | string | The type or category of the log record. See below for a list of well-known values. | `audit`; `app` |
 
 ---
 
@@ -26,6 +27,15 @@ This document defines log attributes
 | `stderr` | Events from stderr stream | ![Development](https://img.shields.io/badge/-development-blue) |
 | `stdout` | Logs from stdout stream | ![Development](https://img.shields.io/badge/-development-blue) |
 
+---
+
+`log.type` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
+
+| Value | Description | Stability |
+| --- | --- | --- |
+| `app` | Default regular application log - everything which is NOT audit relevant | ![Development](https://img.shields.io/badge/-development-blue) |
+| `audit` | Audit log recording security-relevant activities for compliance and forensics. When log.type='audit', the log record SHOULD not get lost and body not changed. | ![Development](https://img.shields.io/badge/-development-blue) |
+
 ## Log File Attributes
 
 Attributes for a file to which log was emitted.

model/log/common.yaml

@@ -4,6 +4,8 @@ groups:
     brief: >
       The attributes described in this section are rather generic. They may be used in any Log Record they apply to.
     attributes:
+      - ref: log.type
+        requirement_level: opt_in
       - ref: log.record.uid
         requirement_level: opt_in
       - ref: log.record.original

model/log/registry.yaml

@@ -5,6 +5,22 @@ groups:
     brief: >
       This document defines log attributes
     attributes:
+      - id: log.type
+        stability: development
+        brief: >
+          The type or category of the log record. See below for a list of well-known values.
+        type:
+          members:
+            - id: audit
+              value: 'audit'
+              brief: >
+                Audit log recording security-relevant activities for compliance and forensics. When log.type='audit', the log record SHOULD not get lost and body not changed.
+              stability: development
+            - id: application
+              value: 'app'
+              brief: 'Default regular application log - everything which is NOT audit relevant'
+              stability: development
+
       - id: log.iostream
         stability: development
         brief: >