I have the same problem trying to extract the trace_id and span_id from a field called contextMap which is of type Map. No matter what I did, it wouldn't get the data from the fields.
So I ended up copying the context of the map to log.cache(a temporary space where you can do some heavy lifting in) where I could then directly access the fields
- merge_maps(log.cache, log.cache["contextMap"], "upsert") where IsMap(log.cache["contextMap"])
- set(log.attributes["span_id"], log.cache["span_id"]) where IsString(log.cache["span_id"])
- set(log.attributes["trace_id"], log.cache["trace_id"]) where IsString(log.cache["trace_id"])
(FYI: the contextMap is already in log.cache since we send our logs as JSON and have otel parse it into log.cache)