# I want replace severity\_label with INFO instead of NOTICE

**URL:** <https://discuss.elastic.co/t/i-want-replace-severity-label-with-info-instead-of-notice/160860>\
**Category:** Logstash\
**Created:** [December 14, 2018, 7:47am UTC](https://discuss.elastic.co/t/i-want-replace-severity-label-with-info-instead-of-notice/160860 "2018-12-14T07:47:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![naga\_kunchala](https://avatars.discourse-cdn.com/v4/letter/n/d9b06d/32.png) [@naga\_kunchala](https://discuss.elastic.co/u/naga_kunchala)\
**Post date:** [December 14, 2018, 7:47am UTC](https://discuss.elastic.co/t/i-want-replace-severity-label-with-info-instead-of-notice/160860/1 "2018-12-14T07:47:33Z")

</div>

hi ,

I am receiving bulk of 'NOTICE' alerts from my logs, so i want to modify that logs as INFO instead of NOTICE. for this i am using the below filter

if [program] == "logstash\_alerts" and "Error getting for log" in [message] {  
mutate {  
replace =\> { "severity\_label" =\> "INFO" }  
}  
}

my intention is when program name is logstash\_alerts and **Error getting for log** message in message then change that severity\_label as INFO. so am able to replace but when save that logs with below output filter still existing NOTICE only. could you please help me any one on this.

file {  
path =\> "/hom/local/trap\_testing/1.log"  
codec =\> line { format=\>"%{message}"}

```
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2019, 7:57am UTC](https://discuss.elastic.co/t/i-want-replace-severity-label-with-info-instead-of-notice/160860/2 "2019-01-11T07:57:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.