Log Levels
Log levels classify messages by severity so operators can filter noise, alert on actionable events, and control storage cost without losing critical signals.
Definition
Log levels are an ordered set of severity labels, typically trace, debug, info, warn, error, and fatal, attached to log records so producers and consumers agree on importance and filtering.
Context and scope
Every service that emits logs needs a severity convention, and every log pipeline needs one for filtering, routing, and retention.
Common misconceptions
- Any error log deserves a page; severity describes the event, not its business impact
- More logging is always safer; excess volume hides the signal operators need
- Level names and ordering are portable across libraries and languages
Anti-patterns
- Logging expected validation failures at error until the alert channel is ignored
- Leaving debug logging enabled in production without retention or redaction
- Using log levels as the only alerting strategy
Related concepts
Related examples
Authoritative source
How it works
Each log record carries a severity from an ordered scale, commonly trace, debug, info, warn, error, and fatal. A logger threshold suppresses records below the configured level, and the pipeline can route levels differently: errors to paging, warnings to a dashboard, debug to short-retention storage. Levels are metadata, so structured logs keep them filterable.
When to use it
Every production service needs a level convention, especially when several libraries and languages share one pipeline. Set info as the production default, keep debug off unless investigating, and reserve error for conditions that need human action. Compared with plain unstructured messages, levels give automated routing and cost control.
Trade-offs
Levels are coarse: an expected validation failure and a database outage may both be errors. Teams inflate levels until everything pages, causing alert fatigue; others suppress warnings and lose early signals. Over-logging debug in production raises cost and can leak sensitive data, so retention and redaction must be configured per level.
Example
A Node.js service logs a failed card authorization at warn with the decline code, a timeout at error, and request payloads at debug. Production runs at info, so payloads never reach storage; a support request temporarily enables debug for one tenant through a scoped flag.
Misconceptions
An error log does not automatically deserve a page; severity is not impact. More logging is not safer, because volume hides signal. Level names also are not portable: syslog and common libraries order them differently, so pipelines should normalize before routing.
Related concepts
A telemetry pipeline routes levels to different backends; sampling controls volume at each level; golden signals define what deserves an alert.