Setting up level with custom name and values

[mladedav]

To print log level with the key severity and with WARNING instead of WARN, you can do this:

    let mut layer = json_subscriber::JsonLayer::stdout();
    layer.with_flattened_event();
    layer.add_dynamic_field("severity", |event, _ctx| {
        match event.metadata().level() {
            &Level::WARN => Some("WARNING"),
            level => Some(level.as_str()),
        }
    });

    Registry::default().with(layer).init();

    tracing::info!("good");
    tracing::warn!("bad");

and the output will be:

{"severity":"INFO","message":"good"}
{"severity":"WARNING","message":"bad"}

[msaunois-dzr]

OMG thank you @mladedav, It's exactly what I needed!

I think I managed to generate logs compliant with GCP with this setup:

let mut layer: JsonLayer = json_subscriber::JsonLayer::stdout();

layer.add_dynamic_field("severity", |event, _ctx| {
    let level = event.metadata().level();
    match level {
        &Level::ERROR => Some("ERROR"),
        &Level::WARN => Some("WARNING"),
        &Level::INFO => Some("INFO"),
        &Level::DEBUG | &Level::TRACE => Some("DEBUG"),
    }
});

layer.add_dynamic_field("spanId", |event, ctx| {
    if let Some(span) = ctx.event_span(event) {
        return Some(span.name());
    }

    None
});

layer
    .with_event("jsonPayload")
    .with_timer("timestamp", SystemTime);

let subscriber = tracing_subscriber::Registry::default().with(layer);
tracing::subscriber::set_global_default(subscriber).unwrap();

The output is:

{"jsonPayload":{"message":"some info message","someField":"some value"},"severity":"ERROR","spanId":"some_span","timestam
 p":"2025-06-18T13:19:47.118078Z"}

[msaunois-dzr]

Actually, my setup was incorrect. The jsonPayload field is automatically added by the log ingestion mechanism. It adds in this object every single field produced by your logs that are not defined in this table: https://cloud.google.com/logging/docs/agent/logging/configuration#special-fields

So the fields I had to define myself are severity and logging.googleapis.com/spanId. For this one I wonder if it is possible to reuse the span ID generated by GCP itself when a request hits my Cloud Run instance. I also removed the timestamp field because it is added by GCP.

Here is my final configuration:

fn setup_gcp_format() {
    let mut layer: JsonLayer = json_subscriber::JsonLayer::stdout();

    layer.with_flattened_event();
    layer.add_dynamic_field("severity", |event, _ctx| {
        let level = event.metadata().level();
        match level {
            &Level::ERROR => Some("ERROR"),
            &Level::WARN => Some("WARNING"),
            &Level::INFO => Some("INFO"),
            &Level::DEBUG | &Level::TRACE => Some("DEBUG"),
        }
    });

    layer.add_dynamic_field("logging.googleapis.com/spanId", |event, ctx| {
        if let Some(span) = ctx.event_span(event) {
            return Some(span.name());
        }

        None
    });

    Registry::default().with(layer).init();
}