Description
Is your feature request related to a problem? Please describe.
There are multiple log formats that put log levels in brackets, like [DEBUG]
or [ERROR]
, including many Java logging libraries like Log4J, Logback, and SLF4J, as well as some docker logging configurations and others. These labels are currently not always detected in our log line detection because in the case of debug and error, we are looking for a :
after the keyword.
Describe the solution you'd like
A log line pushed to loki with no indexed labels or structured metadata indicating the level should be able to detect levels in square brackets.
Describe alternatives you've considered
Do nothing, force level detection to happen on the client.
Additional context
An initial fix to this problem was attempted in #16764, but that fix introduced a bug as words with err
in them like referrer
resulted in error levels. This PR was reverted in #16999, and this bug was created to track a more specific solution to the underlying problem.