I have written a log processing rule to parse a log file. Some log events have a secondary event log level that can be different from primary log level. I want to set both the event's loglevel and status to the secondary log level. When I test the rule it works perfectly, setting both the loglevel and status to "WARNING" using a FIELD_ADD. However, when that rule is used to ingest the log data both fields are set to "NONE". Is there something more I need to do?
Solved! Go to Solution.