<p>I'm currently looking for simplest possible JSON log messages that would simply write a severity and a message to Stackdriver logging from a container that is run in Kubernetes Engine and is using the managed Fluentd daemon.</p>

<p>Basically I'm writing single line JSON entries as follows.</p>

<p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
<div class="snippet-code">
<pre class="snippet-code-js lang-js prettyprint-override"><code>{"severity": "DEBUG", "message": "I'm a debug entry"}
{"severity": "ERROR", "message": "I'm an error entry"}</code></pre>
</div>
</div>
</p>

<p>These end up in Stackdriver logging with following results.</p>

<ul>
<li>Severity is always INFO</li>
<li>There's JSON payload in the log entry, and the only content is the message, i.e. severity does not go there.</li>
</ul>

<p>My conclusion is that Fluentd recognizes log row as JSON, but what I don't understand is that how the severity is not set into log entries correctly. Am I e.g. missing some mandatory fields that need to be in place?</p>

<p>From the information you provided I guess fluentd is passing your whole JSON as as a jsonpayload as a <a href="https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry" rel="noreferrer">logEntry</a> and providing the logName, resource type and the rest of required information from the environment variables.  </p>

<p>In the end what Stackdriver is receiving must look something like this:</p>

<pre><code>{
 "logName": "projects/[YOUR PROJECT ID]/logs/[KUBERNETES LOG]",
 "entries": [
  {
   "jsonPayload": {
    "message": "I'm an ERROR entry",
    "severity": "ERROR"
   },
   "resource": {
    "labels": {
     "project_id": "[YOUR PROJECT ID]",
     "instance_id": "[WHATEVER]",
     "zone": "[YOUR ZONE]"
    },
    "type": "gce_instance"
   }
  }
 ]
}
</code></pre>

<p>So you are actually getting the content of the JSON payload on Stackdriver, but as the severity is defined either <strong>outside</strong> the JSON payload or, if you want to do it inside you'll have to use <code>"severity": enum([NUMERICAL VALUE])</code></p>

<p><a href="https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logseverity" rel="noreferrer">The numerical values of each log level are:</a>  </p>

<blockquote>
  <p>Enums<br>
  DEFAULT (0) The log entry has no assigned severity level.<br>
  DEBUG   (100) Debug or trace information.<br>
  INFO    (200) Routine information, such as ongoing status or performance.<br>
  NOTICE  (300) Normal but significant events, such as start up, shut down, or a configuration change.<br>
  WARNING (400) Warning events might cause problems.<br>
  ERROR   (500) Error events are likely to cause problems.<br>
  CRITICAL    (600) Critical events cause more severe problems or outages.<br>
  ALERT   (700) A person must take an action immediately.<br>
  EMERGENCY   (800) One or more systems are unusable.  </p>
</blockquote>

<p>So, including the field <code>"severity": enum(500)</code> should log the entry as an ERROR instead to fallback to the default INFO.</p>
