Skip to main content

Severities and levels

Every event Log Lens indexes carries a severity, drawn from a fixed set of eight standard levels. Severities drive filtering and decide which events get indexed at all, so it helps to know how they are named, ordered, and normalized.

The standard levels​

Log Lens uses the eight standard PSR-3 levels, from most to least severe:

EMERGENCY  ALERT  CRITICAL  ERROR  WARNING  NOTICE  INFO  DEBUG

This ordering is canonical. Wherever severities are listed or filtered, they appear in this order regardless of how you enter them.

Aliases​

Parsers normalize common variants to a standard level before indexing:

Written in the logStored as
WARNWARNING
ERR, FATALERROR
TRACEDEBUG
(blank)INFO

Matching is case-insensitive, so error, Error, and ERROR all become ERROR. nginx access logs have no level field, so it is derived from the HTTP status: 5xx becomes ERROR, 4xx becomes WARNING, and everything else INFO.

The per-workspace allowlist​

Each workspace has an allowlist of severities it will index. Only events whose (normalized) severity is on the list are stored; everything else is skipped during import. The default for a new workspace is:

ERROR  WARNING

You can change the allowlist at any time. Log Lens validates your selection:

  • Values are uppercased and de-duplicated.
  • Any value outside the eight standard levels is rejected as unknown.
  • The list cannot be empty - you must keep at least one severity.
  • The stored list is re-sorted into canonical severity order.

See Choose which severities to index for the workflow.

Edge cases worth knowing​

  • Non-standard levels are dropped. A parser preserves an unrecognized uppercase level (for example VERBOSE) as-is, but because it is not one of the eight standard levels it can never be on the allowlist, so those events are never indexed.
  • Changing the allowlist requires a reindex. The active severities are folded into the import signature. Widening the list does not retroactively pull in events that were skipped earlier - you must reindex your logs to pick them up. Narrowing it drops the excluded severities on the next reindex.
  • Defaults come from configuration. A fresh workspace seeds its allowlist from a configurable default, falling back to ERROR + WARNING.