I also tried setting the same

host.name

for logs (similar to traces), but I couldn’t get it to work — not sure what I’m missing here. Another question: as you can see, I’m currently reading logs from multiple files. How can I categorize or separate these logs in the Logs tab, so that logs from each file are grouped or distinguished more clearly?

Suggest providing an example of how you're attaching

host.name

. The

filelog

watcher used by the signoz infra agent needs a container operator to add back the k8s info.

Correct, I'm not on k8s. In fact, I'm using Docker to simulate two Linux servers so it resembles the production environment. Regarding the sample you mentioned; as shown in the configuration, I add

host.name

to the logs read from the file using this part of the config:

processors:
attributes/common:
    actions:
      - key: host.name
        value: common_microservice
        action: upsert
  attributes/nginx_access:
    actions:
      - key: service.name
        value: nginx_access
        action: upsert
  attributes/nginx_error:
    actions:
      - key: service.name
        value: nginx_error
        action: upsert
  attributes/php_fpm_error:
    actions:
      - key: service.name
        value: php_fpm_error
        action: upsert
  attributes/whois_microservice_v1:
    actions:
      - key: service.name
        value: whois_microservice_v1
        action: upsert
...
pipelines:
logs/nginx_access:
      receivers: [filelog/nginx_access]
      processors: [attributes/common, attributes/nginx_access]
      exporters: [otlp]
    logs/nginx_error:
      receivers: [ filelog/nginx_error ]
      processors: [attributes/common, attributes/nginx_error]
      exporters: [ otlp ]
    logs/php_fpm_error:
      receivers: [ filelog/php_fpm_error ]
      processors: [attributes/common,  attributes/php_fpm_error ]
      exporters: [ otlp ]
    logs/whois_microservice_v1:
      receivers: [ filelog/whois_microservice_v1 ]
      processors: [attributes/common,  attributes/whois_microservice_v1 ]
      exporters: [ otlp ]

Since you have access to the infrastructure, try bringing up the second view (infra -> logs by host). Then you can check Query Service (or Clickhouse system.query_log) to see what SQL was executed. That'd make it easier to file a bug or know if it's using a different attribute than

host.name

.