[Log Explorer] Show log.level by default in table (if available)

[ruflin]

• 🛑 blocked by: [Log Explorer] Proposal for virtual column implementation #169874

As discussed in #166595, log.level is an important field. Ideally we would show this field also by default in the Log Explorer table. But I would prefer that it doesn't take up much space as a separate column and instead we could use icons or similar to indicate what log level a message is on or colors. The goal is that user can quickly spot what are for example warn or critical messages. More fields like event.severity could play into the state of this.

[elasticmachine]

Pinging @elastic/infra-monitoring-ui (Team:Infra Monitoring UI)

[weltenwort]

• 🔗 related to: [Logs UI] Add rule based colors to log message #28492

• built-in for known message types (e.g. log level for syslog messages)
• apply to a marker at a well-defined position in the line (e.g. a signs column at the beginning as found in many editors and IDEs)

[weltenwort]

This could be implemented using the approach proposed in #169874. I'll mark it as blocked until a decision has been made on that.

[elasticmachine]

Pinging @elastic/obs-ux-logs-team (Team:obs-ux-logs)

[isaclfreire]

My proposal is to have log.level as part of the 'content' smart field / virtual columns. Figma here.

cc @felixbarny

[weltenwort]

If we reserve a fixed width for it, why not put it into its own column? Then we'd just have to implement the nice formatter for it.

[ruflin]

I think of this box as a "special content" box. It can be used for log.level but also for a severity number of no log.level exists or other things we can come up with in the future. So this is no a log.level column much more something we want to highlight from the content.