diff --git a/freeleaps/helm-pkg/authentication/templates/authentication/opentelemetry.yaml b/freeleaps/helm-pkg/authentication/templates/authentication/opentelemetry.yaml
index 757dc7aa..92ced132 100644
--- a/freeleaps/helm-pkg/authentication/templates/authentication/opentelemetry.yaml
+++ b/freeleaps/helm-pkg/authentication/templates/authentication/opentelemetry.yaml
@@ -21,9 +21,13 @@ spec:
       filelog:
         include:
           - {{ .Values.logIngest.logPathPattern }}
-        start_at: beginning
+        start_at: end
         include_file_path: true
         include_file_name: true
+        operators:
+          - type: json_parser
+            parse_from: body
+            parse_to: attribute
     processors:
       k8sattributes:
         auth_type: "serviceAccount"
@@ -57,6 +61,11 @@ spec:
           - key: loki.format
             action: insert
             value: json
+      transform:
+        log_statements:
+          - context: log
+            statements:
+              - merge_maps(attributes, resource.attributes)
       batch:
         send_batch_size: 1000
         timeout: 10s  
@@ -74,6 +83,6 @@ spec:
       pipelines:
         logs:
           receivers: [filelog]
-          processors: [k8sattributes, resource, batch]
+          processors: [k8sattributes, resource, transform, batch]
           exporters: [debug, loki]
 {{- end }}
\ No newline at end of file