README.md in logstash-output-scalyr-0.2.4.beta vs README.md in logstash-output-scalyr-0.2.5.beta

- old
+ new

@@ -84,9 +84,43 @@ mutate { add_field => { "serverHost" => "%{[host][name]}" } } ``` +## Notes on severity (sev) attribute handling + +``sev`` is a special top level DataSet event field which denotes the event severity / log level. + +To enable this functionality, user needs to define ``severity_field`` plugin config option. This +config option tells the plugin which Logstash event field carries the value for the severity field. + +The actual value needs to be an integer between 0 and 6 inclusive. Those values are mapped to +different severity / log levels on DataSet server side as shown below: + +- 0 -> finest +- 1 -> trace +- 2 -> debut +- 3 -> info +- 4 -> warning +- 5 -> error +- 6 -> fatal / emergency / critical + +``` +output { + scalyr { + api_write_token => 'SCALYR_API_KEY' + ... + severity_field => 'severity', + } +} +``` + +In the example above, value for the DataSet severity field should be included in the ``severity`` +Logstash event field. + +In case the field value doesn't contain a valid severity number (0 - 6), ``sev`` field won't be +set on the event object to prevent API from rejecting an invalid request. + ## Options - The Scalyr API write token, these are available at https://www.scalyr.com/keys. This is the only compulsory configuration field required for proper upload `config :api_write_token, :validate => :string, :required => true`