From 05edd49487de244bbd2d4fe5e523d2587d37ce07 Mon Sep 17 00:00:00 2001
From: Richard Hull <rm_hull@yahoo.co.uk>
Date: Wed, 22 May 2024 14:07:45 +0100
Subject: [PATCH] fix: Coerce log level to lowercase when guessing in
 structured json (#2968)

---
 internal/docker/level_guesser.go      | 4 ++--
 internal/docker/level_guesser_test.go | 6 +++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/internal/docker/level_guesser.go b/internal/docker/level_guesser.go
index 966ca7a2..49b08e04 100644
--- a/internal/docker/level_guesser.go
+++ b/internal/docker/level_guesser.go
@@ -44,12 +44,12 @@ func guessLogLevel(logEvent *LogEvent) string {
 
 	case map[string]interface{}:
 		if level, ok := value["level"].(string); ok {
-			return level
+			return strings.ToLower(level)
 		}
 
 	case map[string]string:
 		if level, ok := value["level"]; ok {
-			return level
+			return strings.ToLower(level)
 		}
 	}
 
diff --git a/internal/docker/level_guesser_test.go b/internal/docker/level_guesser_test.go
index ad0606e5..90a3ec7e 100644
--- a/internal/docker/level_guesser_test.go
+++ b/internal/docker/level_guesser_test.go
@@ -6,7 +6,7 @@ import (
 
 func TestGuessLogLevel(t *testing.T) {
 	tests := []struct {
-		input    string
+		input    any
 		expected string
 	}{
 		{"ERROR: Something went wrong", "error"},
@@ -25,6 +25,10 @@ func TestGuessLogLevel(t *testing.T) {
 		{"[foo] [ ERROR] Something went wrong", "error"},
 		{"123 ERROR Something went wrong", "error"},
 		{"123 Something went wrong", ""},
+		{map[string]interface{}{"level": "info"}, "info"},
+		{map[string]interface{}{"level": "INFO"}, "info"},
+		{map[string]string{"level": "info"}, "info"},
+		{map[string]string{"level": "INFO"}, "info"},
 	}
 
 	for _, test := range tests {