# Severity labels **URL:** \ **Category:** Logstash\ **Created:** [November 19, 2015, 9:09am UTC](https://discuss.elastic.co/t/severity-labels/35028 "2015-11-19T09:09:33Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Captain\_Sparklez](https://avatars.discourse-cdn.com/v4/letter/c/9de053/32.png) [@Captain\_Sparklez](https://discuss.elastic.co/u/Captain_Sparklez)\ **Post date:** [November 19, 2015, 9:09am UTC](https://discuss.elastic.co/t/severity-labels/35028/1 "2015-11-19T09:09:33Z")
Hi there! I wanted to check something regarding logging. This might be meant for Watcher but I wasn't sure. I want to try and label my logs based on their values. Lets say I want four categories: Okay, Problem, Warning, Danger. "Okay" is where nothing is particularly wrong with the values. "Problem" is where there is a spike within the data. "Warning" is when there is a constant spike. (For example there have been 10 "Problem" previous logs and when it rises above 10 logged "Problem" it turns into "Warning") "Danger" would appear when there is a dangerous value within the logs. For example it reads that the http status of the server is 404 or when the memory only has 5% left. Is there something within Logstash (or any of the other components) which can assist me with this? If not is there a way to make this? My goal is to watch the health of a single server (not the health check component of indices, though similar but on a smaller scale) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 20, 2015, 2:02am UTC](https://discuss.elastic.co/t/severity-labels/35028/2 "2015-11-20T02:02:30Z")
You could do some of this with a mutate filter, where if http status is 404 then add a tag. Not sure about the rest though, you may be able to use a metric filter to do a similar thing? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/severity-labels/35028/3 "2017-07-06T05:22:04Z")
Closed on July 6, 2017, 5:22am UTC