ClickStack Demo Day (29/05/2026) - Better log parsing

A customer had logs where the event body was a JSON object containing a `level` field. The severity inference logic was doing two things: parsing the body as JSON to extract attributes, then falling back to string matching to infer severity if none was set at the OTel level. The string matching was picking up the word "alert" from an alert manager name inside the body, misclassifying the log level.

The fix adds a guard: if the body parses as JSON and contains a level field, skip the string inference step. The existing smoke test suite — built about a year ago — made it straightforward to verify the fix and catch related edge cases by adding more test scenarios.

Part of the ClickStack Demo Day series. See the full post at https://clickhouse.com/docs/use-cases/observability/clickstack/demo-days/2026/2026-05-29

Видео ClickStack Demo Day (29/05/2026) - Better log parsing канала ClickHouse