Find Graylog messages by log level

Use level:3 to find error messages when level contains numeric syslog severity. Open a representative message first: applications and parsing rules can use different field names or store levels as text.

Read the severity scale correctly

Syslog assigns smaller numbers to more severe conditions:

For error messages only, enter:

level:3

For errors and more severe events, use an inclusive range:

level:[0 TO 3]

To include warnings from one host:

source:app01 AND level:[0 TO 4]

The search time range still applies. A correct severity query cannot find an event outside the selected interval.

Check the fields your input produces

If your pipeline records severity:ERROR, query that field and exact value instead. Do not compare a text label with a numeric range. Syslog inputs parse protocol severity; GELF also defines a numeric level field. Arbitrary JSON needs an appropriate parsing or mapping rule.

If results are empty, inspect an unfiltered message from the same input. Confirm the field name, type, capitalization, and stored value before changing the query. Also check that a later processing rule has not renamed or overwritten the field.

Can the UI show names instead of numbers?

Yes. A pipeline rule can add a separate textual severity field. A decorator can change how results are displayed; display decoration does not rewrite the stored value used by the original query. Keep the numeric field if you rely on range filters.

See the Graylog search syntax reference for field queries and inclusive ranges.