Describe the bug
If you try to detect the log level from a structured log (ie. json) that has a level and/or severity field set to "warning" or "WARNING", it will not correctly identify it and will instead fall through to the logic in detectLevelFromLogLine. If there is a string anywhere in the log line such as "info" or "error", those levels will be picked first (as the logic is sequential), and the log will be mis-identified.

To Reproduce
Steps to reproduce the behavior:

1. Started Loki (main)
2. Submit the following log line

{
  "message":"An error occurred using a transaction.",
  "level":"WARNING",
  "severity":"WARNING"
}

4. Query the stream
5. The log will have the detected_field structured metadata field set to error instead of warn

Expected behavior
The log should be labeled as warn.