[exporter/loki] Make it easier to map OpenTelemetry Severity to Loki level label

[kago-dk]

Is your feature request related to a problem? Please describe.

Currently, the log level is tracked as SeverityText (https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/logs/data-model.md) in v0.60.0, while the same information is tracked in the level label in Loki (https://grafana.com/docs/grafana/latest/explore/logs-integration/). It would be optimal if we could avoid tracking the log level as both "SeverityText" and "level" in the OTEL Collector to make Loki work and support mapping between "SeverityText" and "level" in the Loki Exporter configuration.

Example

If the level is not set, Loki presents the log line as purple because the body text includes the word "Alert"

If the level is set but not part of loki.attribute.labels, then Loki presents the logline as purple because the body text includes the word "Alert"

  attributes/logs:
    actions:
    - action: insert
      key: loki.attribute.labels
      value: net_sock_peer_addr

If the level is set and part of loki.attribute.labels, then Loki presents the logline as green because Loki uses the log level from the level label.

  attributes/logs:
    actions:
    - action: insert
      key: loki.attribute.labels
      value: net_sock_peer_addr,level

Describe the solution you'd like

Support mapping between "SeverityText" and "level" in the Loki Exporter configuration in the OTEL Collector, so the user is not forced into Loki-specific transformation in the OTEL Collector. Ideally, it should happen automatically since the purpose of the fields is the same on both sides.

Describe alternatives you've considered

No response

Additional context

No response

[github-actions]

Pinging code owners: @gramidt @gouthamve @jpkrohling @kovrus @mar4uk. See Adding Labels via Comments if you do not have permissions to add labels yourself.

[jpkrohling]

Sounds reasonable to me! Would you like to open a PR for that?

[kago-dk]

@jpkrohling I do not have the skills to do it.

[jtama]

I don't know if the issue is related but the opentelemtry documentation states :

SeverityText | The severity text (also known as log level).

What actually happens is that severityText contains the original value. If I have the following config :

      - type: regex_parser
        id: extract-nginx-log #Goto end
        parse_from: body
        regex: '(?P<statuscode>\d{3}) .*'
        severity:
          parse_from: attributes.statuscode
          mapping:
            error: "5xx"
            warn: "4xx"
            info: "3xx"
            debug: "2xx"

And the following log :
201 Content created

The log entry will have "201" as severityText and "9" as severity. I would expect the severityText to be info...

[jpkrohling]

I do not have the skills to do it.

Don't worry, thanks for the issue anyway. I'll assign this to me and take a look soon.

[jtama]

Nevermind my previous comment. SeverityText should be the original one.
https://github.com/open-telemetry/opentelemetry-collector/blob/1c217b366fbdb209044d8f4c3fece079ae23bd3b/pdata/internal/data/protogen/logs/v1/logs.pb.go#L371-L372).

The mapping could maybe be done through the "Severity" ? A severity of SeverityNumber_SEVERITY_NUMBER_TRACE could be mapped to TRACE ?

I would be happy to try this one.