Skip to main content

Choose which severities to index

Log Lens only indexes events whose severity is on your allowlist. Everything else in a log file is read, matched against the list, and skipped. Narrow the list to keep noise out; widen it when you need more detail.

Available severities​

Log Lens recognizes eight levels, from most to least severe:

EMERGENCYALERT
CRITICALERROR
WARNINGNOTICE
INFODEBUG

A brand-new workspace starts with ERROR and WARNING indexed. You can change this default for future workspaces with the ingestion.default_severities config key (see the configuration reference); values are uppercased and restricted to the known levels above.

Change the allowlist​

Update the ingested severities in your ingestion settings. When you save, Log Lens:

  • Uppercases and de-duplicates each entry.
  • Rejects any value that is not one of the eight known levels.
  • Requires at least one severity - an empty list is refused with "Select at least one severity to ingest."
  • Stores the list ordered by severity precedence, regardless of the order you supplied.

For example, to capture more context, select:

EMERGENCY, ALERT, CRITICAL, ERROR, WARNING

To focus only on the most urgent events, narrow to EMERGENCY and CRITICAL.

Reindex to apply the change​

Changing the allowlist does not retroactively add or remove events on its own. The severity list is folded into Log Lens's internal import version, so the change only takes effect the next time each source file is imported:

  • Newly added severities are picked up as files are re-read from the start.
  • Removed severities are dropped when their source is reprocessed.

To apply the change everywhere immediately, run a full reindex - this clears each source and re-reads every file against the new list. See Reindex after changing settings.

Notes​

  • Severities you exclude are never stored; they are filtered out during import, not hidden after the fact. Re-adding a level requires reindexing the affected files.
  • Deselecting a severity does not delete already-indexed events until those sources are reprocessed. To remove data directly, see Delete indexed logs by date or source.