Showing results for 
Show  only  | Search instead for 
Did you mean: 

Overriding log event status


I have written a log processing rule to parse a log file.  Some log events have a secondary event log level that can be different from primary log level.  I want to set both the event's loglevel and status to the secondary log level.  When I test the rule it works perfectly, setting both the loglevel and status to "WARNING" using a FIELD_ADD.  However, when that rule is used to ingest the log data both fields are set to "NONE".  Is there something more I need to do?


DynaMight Legend
DynaMight Legend

@MartyM were you able to get this issue resolved? 


@ChadTurner Yes, I just needed to another command to update the status field.

// Make sure the loglevel matches the event status
| FIELDS_ADD(status:UPPER(loglevel))

Featured Posts