datadog replace or manually assign log value

Question

I have a message like 'Service is running' that i'm not able to change, so in log Grok Parser I want to replace it to 'INFO | Service is running' or manually or somehow manually assign like %{level=INFO} . Please kindly advice.

Answer 1

You can do this in a processing pipeline with 2 steps:

1. Set up a Category Processor with a rule that matches on the query Service is running and applies a new attribute to those logs with a value of level:info
2. Set up a Status Remapper to take the status from the attribute called level

If there are other queries/patterns you want to use to determine the log level/status, you can add multiple rules to the Category Processor in (1), and you can map the level value to info/warn/error and any other relevant status value.