How do I handle disparate log formats in a node?

[govardha]

Hello,

I have a set up that I have setup with the Splunk Helm chart. My set up looks pretty close to what's shown below. For most part things work very well, but I am running into a tricky situation that I am not sure what I am doing wrong.

https://github.com/signalfx/splunk-otel-collector-chart/blob/main/examples/only-logs-otel/rendered_manifests/configmap-agent.yaml

I have a bunch of microservices, they are a combination of springboot + c++ pods in a given namespace. Some of the springboot apps logs in a structured json object, but some of them are standard springboot logs. The weird thing is some fo the DEBUG messages followed right behind with some json objects.

I tried identifying if the log is a json object doing a regex match on attributes.log but that flew out of the door when I hit the above situation.

My objective is to ingest containers with structured logs, and unstructured logs and ship it out to my receiver.

Any ideas on how I can handle the situation above?

Thanks!
g