Lexicon
Log levels
Log levels label severity: DEBUG, INFO, WARN, ERROR, FATAL. How normalization works, how levels drive filtering and alerts, and where teams misuse them.
Definition
A log level is the severity label attached to a log line: DEBUG, INFO, WARN, ERROR, and FATAL in the common scheme. Levels declare how much a message matters, and nearly everything downstream, filtering, alerting, retention, cost control, keys off them.
What it means in observability
Levels are the triage system of logging. They let one stream serve two audiences: the engineer who wants every DEBUG detail while reproducing a bug, and the on call responder who wants only what is broken. Because levels gate so much machinery, their consistency matters more than any individual choice: an estate where ERROR reliably means something is wrong and someone should care is an estate where error monitors work, and one where ERROR means a developer once felt strongly is an estate of muted alerts.
How it works in practice
Levels are assigned at emit time by application code and logging frameworks, then normalized at ingest, since raw logs arrive with severities spelled a dozen ways across languages and platforms. Once normalized, levels drive the practical machinery: queries filter to warnings and above, monitors watch error rates, retention policies keep errors longer than debug chatter, and pattern analysis groups recurring messages within a level.
Where it gets hard
Inconsistency is the chronic disease: one team's ERROR is another's INFO, third party dependencies bring their own opinions, and cross estate error alerting inherits the mess. Level inflation makes everything urgent and therefore nothing; DEBUG left on in production quietly floods the pipeline. And the cost reflex, dropping whole levels to save money, discards exactly the surrounding context that turns an error line into an explanation, an economics problem wearing a severity label.
Where Tsuga fits
Tsuga normalizes severities at ingest so levels are consistent and queryable across sources, and its route processors and pattern views make level hygiene visible. New error pattern monitors then catch novel failures the moment they first appear.
Related terms
- Log managementLog management is the practice of collecting, processing, storing, and searching log data at scale: every event record your applications and infrastructure emit, made findable when someone needs it.
- Observability pipelineAn observability pipeline is the layer that moves telemetry from where it is produced to where it is stored, transforming it along the way: parsing, enriching, redacting, filtering, sampling, and routing to one or more destinations.
- SamplingSampling is the practice of keeping only a subset of telemetry, usually traces, so that volume and cost stay manageable.
- TelemetryTelemetry is the data software and infrastructure emit about their own behavior.