Level

Parse

Synopsis

Extracts log levels from text messages by analyzing common logging patterns.

Schema

- level:
    field: <ident>
    target_field: <ident>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Field containing the message to analyze
target_field	N	field	Field to store extracted log level
description	N	-	Documentation note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, skip if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier

Details

The processor detects five log levels: critical, error, warning, info, and debug. It scans the first 7 whitespace-separated fields (up to 255 bytes) using three recognition shapes in order:

1. Glog header: first token matches [IWEF]\d\d\d\d — I→info, W→warning, E→error, F→critical.
2. Keyword scan: tokens are further split on ] ) ; | : , ., leading quote characters (" [ ( < ') are stripped, and a level= key prefix is removed (case-insensitive) before matching. Recognized tokens:

Input	Output
dbg, trc, debug	debug
inf, info, notice	info
wrn, warn, warning	warning
err, error	error
ftl, crit, critical, fatal, emerg, alert	critical

3. Redis log: marker characters .→debug, -→info, * or #→warning.

All keyword matching is case-insensitive. Dotted identifiers such as module.WARN.something are supported — the . delimiter extracts the level component.

warning

Non-string input fields will cause processing errors unless ignore_failure is enabled. When no recognized log level is found, the level is set to "unknown".

Examples

Basic

Extracting the level from a log message...	{ "message": "ERROR: Connection failed" } - level: field: message
grabs the level:	{ "message": "error" }

Store Level

Storing the level in a separate field...	{ "message": "WARNING: Disk space low" } - level: field: message target_field: log_level
preserves the original message:	{ "message": "WARNING: Disk space low", "log_level": "warning" }

Glog Format

Processing a Glog-formatted message...	{ "message": "E0512 15:44:23.123123 123 server.go:123] Failed to connect" } - level: field: message target_field: level
detects the Glog error level:	{ "message": "E0512 15:44:23.123123 123 server.go:123] Failed to connect", "level": "error" }

Error Handling

Handling parsing failures gracefully...	{ "message": 12345 } - level: field: message ignore_failure: true on_failure: - append: field: tags value: level_parse_error
adds error tag and continues execution:	{ "message": 12345, "tags": ["level_parse_error"] }