# Does Graylog allow non-syslog log levels?

**URL:** <https://community.graylog.org/t/does-graylog-allow-non-syslog-log-levels/15917>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [June 13, 2020, 2:24pm UTC](https://community.graylog.org/t/does-graylog-allow-non-syslog-log-levels/15917 "2020-06-13T14:24:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![alitou](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/alitou/32/6651_2.png) [@alitou](https://community.graylog.org/u/alitou)\
**Post date:** [June 13, 2020, 2:24pm UTC](https://community.graylog.org/t/does-graylog-allow-non-syslog-log-levels/15917/1 "2020-06-13T14:24:20Z")

</div>

I’m using a GELF input to forward my logs into Graylog, but I figured out that if I use a `level` key with value other than the 0-7 interval (The one GELF payload specification mentions), Graylog accepts it and is okay with that.

Also according to [this](https://github.com/graylog-labs/graylog2-web-interface/issues/1630) and [this](https://community.graylog.org/t/log-level-field-showing-its-code-how-to-show-log-level-as-warn-error-etc/8477) it seems that there is no special way in the way Graylog handles this field and it is like any other fields to it. Is this correct?

Is the optionality of this field has made it to be able to have arbitrary values? Is it also valid in non-Graylog usages of GELF?

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [June 15, 2020, 7:31am UTC](https://community.graylog.org/t/does-graylog-allow-non-syslog-log-levels/15917/2 "2020-06-15T07:31:23Z")

</div>

Yes graylog normally use level as normal field, and if you want to convert level to syslog text specification, you can either use extractor, pipeline rule or decorator.

---

<div class="post-metadata">

**Author:** ![alitou](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/alitou/32/6651_2.png) [@alitou](https://community.graylog.org/u/alitou)\
**Post date:** [June 15, 2020, 7:48am UTC](https://community.graylog.org/t/does-graylog-allow-non-syslog-log-levels/15917/3 "2020-06-15T07:48:44Z")

</div>

Thanks.  
Does this rule apply also to the GELF standard (and not only the Graylog implementation)?  
As the `level` field is optional, can we assume that we can set any arbitrary value for it and using the mentioned syslog levels is not a MUST? (I mean, in GELF libraries, other logging platforms that accept GELF, etc.)

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [June 15, 2020, 8:06am UTC](https://community.graylog.org/t/does-graylog-allow-non-syslog-log-levels/15917/4 "2020-06-15T08:06:39Z")

</div>

As level field is intented for purpose of severity, it is not recommended to use it for another usage. Also libraries use level field for this:

> **[pygelf](https://pypi.org/project/pygelf/)**
>
> Logging handlers with GELF support

  
[https://www.rubydoc.info/github/graylog-labs/gelf-rb/GELF/Levels](https://www.rubydoc.info/github/graylog-labs/gelf-rb/GELF/Levels)

I would suggest to use custom field e.g `"_app_level"` to use own level from application if it’s differs from level (0-7).

---

<div class="post-metadata">

**Author:** ![alitou](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/alitou/32/6651_2.png) [@alitou](https://community.graylog.org/u/alitou)\
**Post date:** [June 24, 2020, 12:24pm UTC](https://community.graylog.org/t/does-graylog-allow-non-syslog-log-levels/15917/5 "2020-06-24T12:24:42Z")

</div>

Thank you.  
I didn’t mean using for another usage. I meant using it in another way that GELF specification expects (0-7). But the last line of your comment fixed my ambiguity.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 8, 2020, 12:24pm UTC](https://community.graylog.org/t/does-graylog-allow-non-syslog-log-levels/15917/6 "2020-07-08T12:24:47Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
