Why does the collector add en event to a logmessage

[zellen]

We have an application that runs in an app service in Azure and uses Serilog.Sinks.Splunk to send logs directly to the HEC endpoint of Splunk.

Then in our backend, which runs in an AKS-cluster, we use the Splunk Otel Collector to collect our logs and send it to the same HEC endpoint as the app service above.

Both are using the same formatter, SplunkJsonFormatter

Logs that are sent directly from the app service looks like this:

And logs coming from the cluster looks like this where the event is wrapped inside an event:

I want both logs to look the same without our backend logs being wrapped in an extra event.