Log levels, mapped across languages

The OpenTelemetry severity scale

OpenTelemetry gives every log record a SeverityNumber from 1 to 24, in six ranges of four, and an optional SeverityText holding whatever the source called the level. Within a range, a higher number is more severe — ERROR2 (18) is worse than ERROR (17). Zero means unspecified.

Why the native numbers disagree

Each system picked its own direction and spacing. Syslog (RFC 5424) numbers from 0, Emergency, down to 7, Debug, because lower meant more urgent on the wire. Log4j kept that direction in hundreds. Python and pino count up in tens, PSR-3 implementations such as Monolog count up in hundreds with half-steps for Notice and Alert, and Go's slog puts Info at 0 so that Debug is negative. None of those numbers can be compared directly, which is exactly the problem a shared scale solves.

How the right-hand column is decided

When a record arrives with only a level name, the name is matched case-insensitively against a list of aliases — warning and warn are both 13, critical is 18, alert 19, emergency and fatal 21. The column above is computed by that same function in Bilis's ingest path, so it is what Bilis stores. An SDK that sends SeverityNumber itself always wins: if your exporter maps Python's CRITICAL to FATAL, that is what you will see.

Choosing a level

Log at ERROR when something failed and the failure is not handled further up; WARN when it was handled but should not keep happening; INFO for the events you would want in a timeline of an incident; DEBUG for what you need only while fixing one. Most alerting and most noise both come from getting the first two wrong.