Hi,

I am ingesting logs from Filebeat through Logstash and visualizing them using Logtrail 7.4.1-0.1.31 .

despite having standard naming for the fields, I have one application for which the log.level doesn't show in logtrail, while present in the json doc. For other applications, it works, so I am a bit confused..

here's my config : I am expecting to display the log.level along with the message :

  "fields" : {
    "mapping" : {
        "timestamp" : "@timestamp",
        "hostname" : "host.name",
        "program": "service.name",
        "message": "message"
    },
    "message_format": "{{{log.level}}} - {{{message}}}",
    "keyword_suffix" : "keyword"
  },
  "color_mapping" : {
    "field": "log.level",
    "mapping": {
      "ERROR": "#FF0000",
      "WARN": "#FFEF96",
      "DEBUG": "#B5E7A0",
      "TRACE": "#CFE0E8"
    }
  }

here's what I see in Logtrail :

But if I look into the json document, log.level is there :

For another application, it works as expected, ie log.level shows up :

while the json document is very similar to the one that doesn't work :

Do you have any idea of what could be happening here ?

Thanks !