Severity & the level Field

Graylog

Chapter 3 · Severity & the level Field

Once a query is scoped to the right service, account, or cluster, the next real question is usually "how bad is it?" — and that's exactly what the level field answers.

The Real Syslog Severity Scale

level holds a real, standard syslog severity value (RFC 5424) — and the numbering is genuinely counter-intuitive the first time you see it: lower numbers mean more severe, the opposite of how a 1-to-10 "severity rating" usually works.

Value	Real syslog name
0	Emergency
1	Alert
2	Critical
3	Error
4	Warning
5	Notice
6	Informational
7	Debug

In real day-to-day use at logger.daxtra.io

Daxtra's own services don't populate all eight levels in practice — the ones that actually show up day to day are 2 (critical), 3 (error), 4 (warning), 6 (info), and 7 (debug). Levels 0 (Emergency), 1 (Alert), and 5 (Notice) exist in the standard, but aren't part of the real, working vocabulary here — don't spend time searching for them.

Querying by Severity

A single severity value is a plain field match:

level:3

Group several severities together the same way Chapter 1 covered grouping any other field:

level:(2 OR 3)

Lucene also supports real range comparisons on numeric fields, using < and > directly:

level:<3

Watch the Direction (and the Edge) of the Inequality

level:<3 does NOT include error (3) itself

Because lower numbers mean more severe, level:<3 matches only levels 0, 1, and 2 — Emergency, Alert, and Critical — genuinely excluding level 3 (Error) itself. In real day-to-day use at logger.daxtra.io, where levels 0 and 1 aren't actually populated, level:<3 effectively means "critical only." If what you actually want is "error or worse," the safer, unambiguous query is the explicit OR-grouping from earlier in this chapter — level:(2 OR 3) — or a less-than-or-equal comparison, level:<=3. Always double-check which one you actually meant before trusting the results of a level range query; the off-by-one mistake here is easy to make and doesn't produce any kind of warning, just a silently narrower result set than intended.

Hands-On Exercises

Exercise 1

Using this chapter's own real severity table, name the syslog severity name for level 4, and state whether it's more or less severe than level 6.

📄 View solution

Exercise 2

Write a query, using this chapter's own real syntax, that matches every message at warning level or more severe (levels 2, 3, and 4) for the ws-lite service — using the explicit OR-grouping form, not a range comparison.

📄 View solution

Exercise 3

A colleague writes level:<4 expecting it to include warning-level (4) messages. Using this chapter's own material, explain why it doesn't, and give the corrected query.

📄 View solution

Chapter 3 Quick Reference

The real syslog severity scale (RFC 5424): 0=Emergency, 1=Alert, 2=Critical, 3=Error, 4=Warning, 5=Notice, 6=Informational, 7=Debug
Lower number = more severe — the opposite of a typical 1-10 severity rating
In real use at logger.daxtra.io, only levels 2, 3, 4, 6, and 7 actually appear — 0, 1, and 5 aren't part of the working vocabulary
level:(2 OR 3) groups severities explicitly; level:<3 is a range comparison — watch the direction and the edge, since level:<3 excludes level 3 itself
Next chapter: Correlation IDs — Following One Request or Job Across Log Lines