Snippets · Processors

Filter logs by severity (WARN and above)

DEBUG and INFO are most of the volume and little of the value once a service is stable. This filter drops records below WARN, and it deliberately keeps records with no severity number, so a source that never sets one is not wiped out by the filter.

OpenTelemetry Collector

OpenTelemetry Collector YAML

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  # Drops DEBUG and INFO log records. Records with no severity number are
  # kept, so logs from sources that never set one are not lost.
  filter/min-severity-warn:
    error_mode: ignore
    logs:
      log_record:
        - severity_number != SEVERITY_NUMBER_UNSPECIFIED and severity_number < SEVERITY_NUMBER_WARN
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [memory_limiter, filter/min-severity-warn, batch]
      exporters: [otlphttp]

LinkMesh

LinkMesh has no built-in template for this job. Add it as a custom processor in raw mode, with filter as the component type and this body - the same lines as under filter/min-severity-warn in the collector config:

Custom processor body (filter)

error_mode: ignore
logs:
  log_record:
    - severity_number != SEVERITY_NUMBER_UNSPECIFIED and severity_number < SEVERITY_NUMBER_WARN

How custom components are validated and rolled out: create a custom processor.

Download config.yamlValidated with otelcol-contrib v0.161.0 on 2026-10-26

Complete config files, each checked with the collector's own validate command (otelcol-contrib v0.161.0). Replace https://your-backend:4318 with your own OTLP endpoint before you run it.

Before and after

Example telemetry in, and what this exact config sent out when we ran it in otelcol-contrib v0.161.0. CI re-runs it on every change and fails if the output differs. Changed values are highlighted.

7 log records in, 5 log records out

Before
body
cache miss for key cart:42
severity
DEBUG
severity_number
5
resource.service.name
checkout
After
Dropped
Before
body
order 1002 accepted
severity
INFO
severity_number
9
resource.service.name
checkout
After
Dropped
Before
body
payment provider slow (1.8 s)
severity
WARN
severity_number
13
resource.service.name
checkout
After
body
payment provider slow (1.8 s)
severity
WARN
severity_number
13
resource.service.name
checkout
Before
body
payment provider timeout
severity
ERROR
severity_number
17
resource.service.name
checkout
After
body
payment provider timeout
severity
ERROR
severity_number
17
resource.service.name
checkout
Before
body
database unreachable, shutting down
severity
FATAL
severity_number
21
resource.service.name
checkout
After
body
database unreachable, shutting down
severity
FATAL
severity_number
21
resource.service.name
checkout
Before
body
ERROR connection refused (no severity set)
resource.service.name
checkout
After
body
ERROR connection refused (no severity set)
resource.service.name
checkout
Before
body
severity text only, no number
severity
DEBUG
resource.service.name
checkout
After
body
severity text only, no number
severity
DEBUG
resource.service.name
checkout

The gotcha

The comparison reads severity_number, never severity_text. In our test a record with severity text DEBUG and no number was kept, because to the filter it has no severity: 7 records in, 5 out. If your source only sets the text, map it to a number in a parser before this processor.

Manage this across a fleet

LinkMesh manages collector configuration across a fleet from one self-hosted control plane, so a change like this is made once rather than host by host. The first 25 Collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one).

Doing this in LinkMesh: Drop noisy logs

Install LinkMesh →See all snippets