---
title: Logs Show Info Status For Warnings Or Errors
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Log Management > Logs Guides > Logs Show Info Status For Warnings Or
  Errors
---

# Logs Show Info Status For Warnings Or Errors

## Overview{% #overview %}

By default, when Datadog's Intake API receives a log, an `INFO` status generates and appends itself as the `status` attribute.

{% image
   source="https://docs.dd-static.net/images/logs/guide/original_log.5f1449adb64876d5b4d4aac0e624b41b.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/guide/original_log.5f1449adb64876d5b4d4aac0e624b41b.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Log panel showing a log with info status but the message showing warning." /%}

This default `status` may not always reflect the actual status contained in the log itself. This guide walks you through how to override the default value with the actual status.

## Raw logs{% #raw-logs %}

If your raw logs are not showing the correct status in Datadog, extract the correct log status from the raw logs and remap it to the right status.

### Extract the status value with a parser{% #extract-the-status-value-with-a-parser %}

Use a Grok parser to define a rule with the [`word()` matcher](https://docs.datadoghq.com/logs/log_configuration/parsing.md) and extract the actual log status.

1. Navigate to [Logs Pipelines](https://app.datadoghq.com/logs/pipelines/) and click on the pipeline processing the logs.
1. Click **Add Processor**.
1. Select **Grok Parser** for the processor type.
1. Use the [`word()` matcher](https://docs.datadoghq.com/logs/log_configuration/parsing.md) to extract the status and pass it into a custom `log_status` attribute.

For example, the log may look like:

```
WARNING: John disconnected on 09/26/2017
```

Add a rule like:

```
MyParsingRule %{word:log_status}: %{word:user.name} %{word:action}.*
```

The output for `MyParsingRule`'s extraction:

```
{
  "action": "disconnected",
  "log_status": "WARNING",
  "user": {
    "name": "John"
  }
}
```

### Define a log status remapper{% #define-a-log-status-remapper %}

The `log_status` attribute contains the correct status. Add a [Log Status remapper](https://docs.datadoghq.com/logs/log_configuration/processors.md#log-status-remapper) to make sure the status value in the `log_status` attribute overrides the default log status.

1. Navigate to [Logs Pipelines](https://app.datadoghq.com/logs/pipelines/) and click on the pipeline processing the logs.
1. Click **Add Processor**.
1. Select Status remapper as the processor type.
1. Enter a name for the processor.
1. Add **log\_status** to the Set status attribute(s) section.
1. Click **Create**.

{% image
   source="https://docs.dd-static.net/images/logs/guide/log_post_processing.37cfe820bcebf8d550b6fe56e027cf7e.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/guide/log_post_processing.37cfe820bcebf8d550b6fe56e027cf7e.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Log panel showing a log with a warn status that matches the severity attribute's value of warning" /%}

Modifications of a pipeline impacts new logs only because all the processing is done in the intake process.

## JSON logs{% #json-logs %}

JSON logs are automatically parsed in Datadog. Because the log `status` attribute is a [reserved attribute](https://docs.datadoghq.com/logs/log_configuration/attributes_naming_convention.md#reserved-attributes), it goes through pre-processing operations for JSON logs.

In this example, the actual status of the log is the value of the `logger_severity` attribute, not the default `INFO` log status.

{% image
   source="https://docs.dd-static.net/images/logs/guide/new_log.d81f1a7fd19aff0f454b01658668e4c7.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/guide/new_log.d81f1a7fd19aff0f454b01658668e4c7.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Log panel showing a log with info status but the logger_severity attribute value is error" /%}

To make sure the `logger_severity` attribute value overrides the default log status, add `logger_severity` to the list of status attributes.

1. Navigate to [Logs Pipelines](https://app.datadoghq.com/logs/pipelines/) and click on the pipeline processing the logs.
1. Hover over Preprocessing for JSON Logs, and click the pencil icon.
1. Add `logger_severity` to the list of status attributes. The status remapper looks for every reserved attribute in the order they are listed. To ensure the status comes from the `logger_severity` attribute, place it first in the list.
1. Click **Save**.

{% image
   source="https://docs.dd-static.net/images/logs/guide/new_log_remapped.cdfdd41a75c3a46078673aeb590bbcb6.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/guide/new_log_remapped.cdfdd41a75c3a46078673aeb590bbcb6.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Log panel showing a log with an error status that matches the logger_severity attribute value of error" /%}

Modifications of a pipeline impacts new logs only because all the processing is done in the ingestion process. New logs are correctly configured with the `logger_severity` attribute value.

In order for the remapping to work, you must adhere to the status formats specified in the [Processors documentation](https://docs.datadoghq.com/logs/log_configuration/processors.md#log-status-remapper).

## Further Reading{% #further-reading %}

- [Learn how to remap custom severity values to the official log status](https://docs.datadoghq.com/logs/guide/remap-custom-severity-to-official-log-status.md)
- [Learn how to process your logs](https://docs.datadoghq.com/logs/log_configuration/processors.md)
- [Learn about parsing](https://docs.datadoghq.com/logs/log_configuration/parsing.md)
- [Learn how to investigate a log parsing issue](https://docs.datadoghq.com/logs/faq/how-to-investigate-a-log-parsing-issue.md)