Snippets · Processors

Keep only error logs

Some sources are worth keeping only when they fail. This filter processor drops every log record whose severity number is below ERROR, so only ERROR and FATAL leave the collector.

OpenTelemetry Collector

OpenTelemetry Collector YAML

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  # Keeps ERROR and FATAL log records and drops everything else, including
  # records that carry no severity at all.
  filter/keep-error-logs:
    error_mode: ignore
    logs:
      log_record:
        - severity_number < SEVERITY_NUMBER_ERROR
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [memory_limiter, filter/keep-error-logs, batch]
      exporters: [otlphttp]

LinkMesh

LinkMesh has no built-in template for this job. Add it as a custom processor in raw mode, with filter as the component type and this body - the same lines as under filter/keep-error-logs in the collector config:

Custom processor body (filter)

error_mode: ignore
logs:
  log_record:
    - severity_number < SEVERITY_NUMBER_ERROR

How custom components are validated and rolled out: create a custom processor.

Download config.yamlValidated with otelcol-contrib v0.161.0 on 2026-10-26

Complete config files, each checked with the collector's own validate command (otelcol-contrib v0.161.0). Replace https://your-backend:4318 with your own OTLP endpoint before you run it.

Before and after

Example telemetry in, and what this exact config sent out when we ran it in otelcol-contrib v0.161.0. CI re-runs it on every change and fails if the output differs. Changed values are highlighted.

7 log records in, 2 log records out

Before
body
cache miss for key cart:42
severity
DEBUG
severity_number
5
resource.service.name
checkout
After
Dropped
Before
body
order 1002 accepted
severity
INFO
severity_number
9
resource.service.name
checkout
After
Dropped
Before
body
payment provider slow (1.8 s)
severity
WARN
severity_number
13
resource.service.name
checkout
After
Dropped
Before
body
payment provider timeout
severity
ERROR
severity_number
17
resource.service.name
checkout
After
body
payment provider timeout
severity
ERROR
severity_number
17
resource.service.name
checkout
Before
body
database unreachable, shutting down
severity
FATAL
severity_number
21
resource.service.name
checkout
After
body
database unreachable, shutting down
severity
FATAL
severity_number
21
resource.service.name
checkout
Before
body
ERROR connection refused (no severity set)
resource.service.name
checkout
After
Dropped
Before
body
severity text only, no number
severity
DEBUG
resource.service.name
checkout
After
Dropped

The gotcha

A record with no severity number counts as below ERROR, so it is dropped even if it says ERROR in plain text. In our test "ERROR connection refused" without a severity number was dropped with the INFO and DEBUG lines: 7 records in, 2 out. Logs read from files have no severity number until a parser sets one; parse the severity first (see filter-by-severity for a version that keeps unparsed records).

Manage this across a fleet

LinkMesh manages collector configuration across a fleet from one self-hosted control plane, so a change like this is made once rather than host by host. The first 25 Collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one).

Doing this in LinkMesh: Drop noisy logs

Install LinkMesh →See all snippets