---
name: cloud-logs-agent-severity
title: Understanding how the Logging agent parses severities
description: The IBM Cloud Logs Logging agent will attempt to determine the severity value of a routed log record. If the Logging agent cannot determine the severity of a log record, it sets the severity to `info`.
last-updated: 2025-04-23
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cloud-logs?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Understanding how the Logging agent parses severities
{: #agent-severity}

The IBM Cloud Logs Logging agent will attempt to determine the severity value of a routed log record. If the Logging agent cannot determine the severity of a log record, it sets the severity to `info`.
{: shortdesc}

The severity of a log record is extracted after the log was picked up and modified by the Logging agent.
This means, that all filters and modifications defined in the Logging agent configuration are applied before the record is parsed in preparation for sending it to an IBM Cloud Logs instance.

Severity parsing is done in a specific order.
As soon as a match is found, the parsing is completed and subsequent steps are not executed.

First, the top level elements of the record are searched for fields named `severity`, `level` or `logLevel`, in that order.
If a match is found, the corresponding value is mapped according to the mapping table.
The mapping is case-insensitive and will find all upper-case and lower-case spellings.

If the first step did not yield any results, the same fields (`severity`, `level` or `logLevel`) are searched nested below the keys `message` and `log`.
If a match is found, the value is mapped as described in the mapping table, where upper-case and lower-case spellings are not relevant.

| Log record severity value (case-insensitive) | Mapped to | API mapped value |
|----------------------------------------------|-----------|------------------|
| `debug` | `Debug` | 1 |
| `verbose` | `Verbose` | 2 |
| `info` | `Info` | 3 |
| `warn` | `Warn` | 4 |
| `warning` | `Warn` | 4 |
| `error` | `Error` | 5 |
| `err` | `Error` | 5 |
| `critical` | `Critical` | 6 |
| `crit` | `Critical` | 6 |
| `alert` | `Critical` | 6 |
| `emerg` | `Critical` | 6 |
{: caption="Mapping of log record severity values to IBM Cloud Logs severity values" caption-side="bottom"}

Should the first steps not find any of the predefined field names, a simple text search is applied to fields named `message` and `log`.
In this case, the search is case-sensitive and will only find the spellings defined in the mapping table.

| Log record severity value | Mapped to | API mapped value |
|---------------------------|-----------|------------------|
| `debug`, `Debug`, `DEBUG` | `Debug` | 1 |
| `verbose`, `Verbose`, `VERBOSE` | `Verbose` | 2 |
| `info`, `Info`, `INFO` | `Info` | 3 |
| `warn`, `Warn`, `WARN` | `Warn` | 4 |
| `error`, `Error`, `ERROR` | `Error` | 5 |
| `critical`, `Critical`, `CRITICAL` | `Critical` | 6 |
{: caption="Mapping of text search severity values to IBM Cloud Logs severity values" caption-side="bottom"}