Level

Parse

Synopsis

Extracts log levels from text messages by analyzing common logging patterns.

Schema

level:
  - field: <ident>
  - target_field: <ident>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - ignore_missing: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>

Configuration

Field	Required	Default	Description
field	Y	-	Field containing the message to analyze
target_field	N	field	Field to store extracted log level
description	N	-	Documentation note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, skip if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier

Details

The processor detects five log levels: critical, error, warning, info, and debug. It supports multiple logging formats including standard text levels, Google's Glog format, and Redis log formats.

note

The processor examines only the first few fields of messages and truncates very long messages for efficient processing. Log level detection is case-insensitive and handles common variations and abbreviations.

warning

Non-string input fields will cause processing errors unless ignore_failure is enabled. When no recognized log level is found, the level is set to "unknown".

Examples

Basic

Extracting the level from a log message...	{ "message": "ERROR: Connection failed" } level: - field: message
grabs the level:	{ "message": "error" }

Store Level

Storing the level in a separate field...	{ "message": "WARNING: Disk space low" } level: - field: message - target_field: log_level
preserves the original message:	{ "message": "WARNING: Disk space low", "log_level": "warning" }

Glog Format

Processing a Glog-formatted message...	{ "message": "E0512 15:44:23.123123 123 server.go:123] Failed to connect" } level: - field: message - target_field: level
detects the Glog error level:	{ "message": "E0512 15:44:23.123123 123 server.go:123] Failed to connect", "level": "error" }

Error Handling

Handling parsing failures gracefully...	{ "message": 12345 } level: - field: message - ignore_failure: true - on_failure: - append: field: tags value: level_parse_error
adds error tag and continues execution:	{ "message": 12345, "tags": ["level_parse_error"] }