[APM][ECO] Include ERROR in the error.log.level filter (elastic#1…

…92269)

## Summary

closes elastic#192158 

 

https://github.com/user-attachments/assets/8d79ef8b-2957-4870-98f4-d2eb5804b1b2

packages/kbn-apm-types/src/es_fields/apm.ts

@@ -196,3 +196,5 @@ export const CLIENT_GEO_CITY_NAME = 'client.geo.city_name';
 export const CLIENT_GEO_REGION_NAME = 'client.geo.region_name';
 
 export const CHILD_ID = 'child.id';
+
+export const LOG_LEVEL = 'log.level';

x-pack/plugins/observability_solution/apm/public/components/app/entities/charts/log_error_rate_chart.tsx

@@ -9,6 +9,7 @@ import { i18n } from '@kbn/i18n';
 import { EuiPanel, EuiTitle, EuiFlexItem, EuiFlexGroup } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { css } from '@emotion/react';
+import { SERVICE_NAME } from '@kbn/observability-shared-plugin/common';
 import { useApmParams } from '../../../../hooks/use_apm_params';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { useTimeRange } from '../../../../hooks/use_time_range';
@@ -23,6 +24,8 @@ import {
   getMetricsFormula,
 } from '../../../shared/charts/helper/get_metrics_formulas';
 import { ExploreLogsButton } from '../../../shared/explore_logs_button/explore_logs_button';
+import { mergeKueries, toKueryFilterFormat } from '../../../../../common/utils/kuery_utils';
+import { ERROR_LOG_LEVEL, LOG_LEVEL } from '../../../../../common/es_fields/apm';
 
 type LogErrorRateReturnType =
   APIReturnType<'GET /internal/apm/entities/services/{serviceName}/logs_error_rate_timeseries'>;
@@ -74,6 +77,14 @@ export function LogErrorRateChart({ height }: { height: number }) {
     },
   ];
 
+  const errorLogKueryFormat = mergeKueries(
+    [
+      toKueryFilterFormat(LOG_LEVEL, ['error', 'ERROR']),
+      toKueryFilterFormat(ERROR_LOG_LEVEL, ['error', 'ERROR']),
+    ],
+    'OR'
+  );
+
   return (
     <EuiPanel hasBorder>
       <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
@@ -123,7 +134,10 @@ export function LogErrorRateChart({ height }: { height: number }) {
             <ExploreLogsButton
               start={start}
               end={end}
-              kuery={`(log.level: error OR error.log.level: error) AND service.name: "${serviceName}"`}
+              kuery={mergeKueries([
+                `(${errorLogKueryFormat})`,
+                toKueryFilterFormat(SERVICE_NAME, [serviceName]),
+              ])}
             />
           </EuiFlexItem>
         </EuiFlexGroup>

x-pack/plugins/observability_solution/entity_manager/server/lib/entities/built_in/services.ts

@@ -20,7 +20,7 @@ const serviceTransactionFilter = (additionalFilters: string[] = []) => {
 
 export const builtInServicesFromLogsEntityDefinition: EntityDefinition =
   entityDefinitionSchema.parse({
-    version: '1.0.1',
+    version: '1.0.2',
     id: `${BUILT_IN_ID_PREFIX}services_from_ecs_data`,
     name: 'Services from ECS data',
     description:
@@ -109,7 +109,8 @@ export const builtInServicesFromLogsEntityDefinition: EntityDefinition =
           {
             name: 'A',
             aggregation: 'doc_count',
-            filter: 'log.level: "error" OR log.level: "ERROR" OR error.log.level: "error"',
+            filter:
+              'log.level: "error" OR log.level: "ERROR" OR error.log.level: "error" OR error.log.level: "ERROR"',
           },
         ],
       },