Detection rules
| Format | Detection | Example |
|---|---|---|
| JSON | First line starts with { | {"level":"error","message":"timeout"} |
| logfmt | First line has ≥2 key=value pairs | level=error msg="timeout" req=abc |
| syslog | First line starts with a month abbreviation (Jan) or <priority> tag | Jan 15 10:30:00 myhost myapp[1234]: error |
| Plain text | Everything else | 2024-01-15 10:30:06 ERROR timeout |
Auto-mapped fields
Several common field name variations are normalized automatically so that standard filters likelevel = "error" work regardless of how the field was named in your logs.
| Canonical field | Recognized aliases |
|---|---|
level | lvl, severity, log_level, loglevel |
message | msg, text, body |
timestamp | ts, time, t, @timestamp, datetime, date |
raw / line | The original unparsed log line |
lvl=warn and a Java app that writes severity=WARN both match WHERE level = "warn".
Format pages
JSON
Structured JSON logs with full field access and numeric comparisons.
logfmt
Key-value format used by Go apps, Heroku, and many cloud services.
Plain text
Syslog, Apache access logs, and any other line-based format.