Overriding log event status

[MartyM]

I have written a log processing rule to parse a log file.  Some log events have a secondary event log level that can be different from primary log level.  I want to set both the event's loglevel and status to the secondary log level.  When I test the rule it works perfectly, setting both the loglevel and status to "WARNING" using a FIELD_ADD.  However, when that rule is used to ingest the log data both fields are set to "NONE".  Is there something more I need to do?

[ChadTurner]

@MartyM were you able to get this issue resolved? 

[MartyM · Accepted solution]

@ChadTurner Yes, I just needed to another command to update the status field.

// Make sure the loglevel matches the event status

| FIELDS_ADD(status:UPPER(loglevel))