Why does the session field change from the value submitted via addEvents API?

When calling the DataSet addEvents API, the session field is required. It is an arbitrary string which should uniquely define the lifetime of the process which is uploading events. DataSet uses this to maintain state with each process that is sending data to DataSet, notably, to prevent duplicates and ensure logs are received in order.

You may notice that the value you submit for session is not the same as what appears in search results within the DataSet UI. session is treated as an internal field. At various stages in the ingestion pipeline, we may modify the value in this field. In particular, there are various circumstances under which we will split a session into several parallel sessions. For instance, if the DataSet Agent sends data from multiple log files, we will create a separate session for each file. Or if the total data volume being received under a single session ID is large, we split that into multiple sessions so that the logs can be distributed to multiple servers on our end. In other words, there is no guarantee that the session ID passed to addEvents will show up in the session field of the ingested events.