I have a .NET webservice that writes logs and metrics to an OpenTelemetry endpoint.

I have Telegraf configured with an OpenTelemetry input, and an InfluxDB output.

So far so good ... all the logging and tracing (spans) are getting picked up by Telegraf and pushed to an InfluxDB bucket, and I can see them all using simple SELECT statements.

My question relates to the format of the resulting database entries, which seem to be in tables that conform to OpenTelemetry data models. The tables contain a string column called attributes, which seems to contain all the "interesting" bits of the entry (e.g. any IDs, context, etc) all wrapped up in a big JSON string. Here's an example from the log table:

{"EventId":"{ Id: 262679994, Name: \"NameOfLoggingEvent\" }","SourceContext":"Name.Of.Class.That.Log.Was.Made.From","emailId":"big_id_string","telemetry.sdk.language":"dotnet","telemetry.sdk.name":"opentelemetry","telemetry.sdk.version":"1.8.0"}   

So that's great, but how would I go about querying these entries? For example, if I wanted to query all entries pertaining to a particular emailId, or with a particular SourceContext? As far as I can see, there is no way to query JSON content in InfluxDB?

Is InfluxDB a bad choice for the output?

Or is there a way to "break out" the attributes into separate columns using a Telegraf processor? (I had a look, but didn't see much scope for doing that)

If anyone could offer some best-practice advice, I'd be very grateful.