Skip to content

Detect log levels in brackets, like [DEBUG] or [ERROR] #17005

Open
@trevorwhitney

Description

@trevorwhitney

Is your feature request related to a problem? Please describe.
There are multiple log formats that put log levels in brackets, like [DEBUG] or [ERROR], including many Java logging libraries like Log4J, Logback, and SLF4J, as well as some docker logging configurations and others. These labels are currently not always detected in our log line detection because in the case of debug and error, we are looking for a : after the keyword.

Describe the solution you'd like
A log line pushed to loki with no indexed labels or structured metadata indicating the level should be able to detect levels in square brackets.

Describe alternatives you've considered
Do nothing, force level detection to happen on the client.

Additional context
An initial fix to this problem was attempted in #16764, but that fix introduced a bug as words with err in them like referrer resulted in error levels. This PR was reverted in #16999, and this bug was created to track a more specific solution to the underlying problem.

Metadata

Metadata

Assignees

Labels

type/featureSomething new we should do

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions