# Graylog and Windows log level does not match

**URL:** <https://community.graylog.org/t/graylog-and-windows-log-level-does-not-match/2017>\
**Category:** Graylog Central (peer support)\
**Created:** [August 9, 2017, 9:47am UTC](https://community.graylog.org/t/graylog-and-windows-log-level-does-not-match/2017 "2017-08-09T09:47:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gerryrigney](https://avatars.discourse-cdn.com/v4/letter/g/977dab/32.png) [@gerryrigney](https://community.graylog.org/u/gerryrigney)\
**Post date:** [August 9, 2017, 9:47am UTC](https://community.graylog.org/t/graylog-and-windows-log-level-does-not-match/2017/1 "2017-08-09T09:47:29Z")

</div>

Hi, I realise this may not be strictly a Graylog issue as I’m not sure where the level number is changing but it might be. I’m running nxlog on some Windows servers to send all logs to Graylog. I have some alerts and dashboards setup to highlight events with a level \<3 (so errors and warnings). Nothing is showing up in the alerts or dashboards.

When I look at an error log details on the Windows server it has a level of 2. The same error is showing up in Graylog but it has a level of 3. I’m just wondering if anyone knows why the level number does not match?  
Screen shot below of the same error.  
Thanks for any help,

![image](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/flex016/uploads/graylog/original/1X/543ef73b9bef8f691b35ce7deb39232621a337e4.png)  
 ![image](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/flex016/uploads/graylog/original/1X/695760c3ff2b1df458e753b5537ed628ff94f206.png)

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 9, 2017, 12:11pm UTC](https://community.graylog.org/t/graylog-and-windows-log-level-does-not-match/2017/2 "2017-08-09T12:11:00Z")

</div>

Log levels in Windows and Graylog do not use the same model.

For example Windows Event Log Level 2 means “Error” (see [https://msdn.microsoft.com/en-us/library/microsoft.windowsazure.diagnostics.loglevel.aspx](https://msdn.microsoft.com/en-us/library/microsoft.windowsazure.diagnostics.loglevel.aspx)) while Graylog Log Level 2 means critical (see [https://en.wikipedia.org/wiki/Syslog#Severity\_level](https://en.wikipedia.org/wiki/Syslog#Severity_level)).

Since you probably want to use the same meaning and scale of “level” in all of your log messages, Graylog already did the right thing™ and translated Windows Event Log Level 2 (Error) to Graylog/Syslog Log Level 3 (Error).

---

<div class="post-metadata">

**Author:** ![gerryrigney](https://avatars.discourse-cdn.com/v4/letter/g/977dab/32.png) [@gerryrigney](https://community.graylog.org/u/gerryrigney)\
**Post date:** [August 10, 2017, 7:57am UTC](https://community.graylog.org/t/graylog-and-windows-log-level-does-not-match/2017/3 "2017-08-10T07:57:18Z")

</div>

Thanks jochen, so I will set my Graylog filters based on EventType or Severity to match the Windows logs.  
Rgds

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 24, 2017, 7:57am UTC](https://community.graylog.org/t/graylog-and-windows-log-level-does-not-match/2017/4 "2017-08-24T07:57:36Z")

</div>

Closed on August 24, 2017, 7:57am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.