GRAYLOG - Chapter 3, Exercise 3 Solution
==========================================================
Why level:<4 Excludes Warning Messages

PROBLEM
-------
A colleague writes level:<4 expecting it to include warning-level (4)
messages. Using this chapter's own material, explain why it doesn't,
and give the corrected query.

SOLUTION
--------
This chapter's own warn-box established the exact same real off-by-one
pattern for level:<3 excluding level 3 itself - the identical logic
applies here. level:<4 is a strict "less than" comparison, matching
only levels 0, 1, 2, and 3 (Emergency, Alert, Critical, and Error) -
genuinely excluding level 4 (Warning) itself, since 4 is not less than
4.

To actually include warning-level messages, either:

    1. Use the explicit OR-grouping form:
       level:(2 OR 3 OR 4)

    2. Or use a less-than-or-equal comparison:
       level:<=4

ANSWER: level:<4 excludes level 4 (Warning) because it's a strict
"less than" comparison, not "less than or equal to." The corrected
query is either level:(2 OR 3 OR 4) or level:<=4, both of which
genuinely include warning-level messages.

----
WHY THIS WORKS AS AN ANSWER

This directly reuses the chapter's own warn-box reasoning, just shifted
one level higher (4 instead of 3), confirming the same off-by-one
mistake generalizes to any level:< comparison, not just the specific
level:<3 example the chapter used to introduce it. The chapter's own
two suggested fixes - explicit OR-grouping or a <= comparison - both
apply here identically.