Change log level in eventlogmessage

CHANGELOG.md

@@ -71,6 +71,8 @@ Main (unreleased)
 
 - Fixed an issue where the `otelcol.processor.interval` could not be used because the debug metrics were not set to default. (@wildum)
 
+- Change the log level in the `eventlogmessage` stage of the `loki.process` component from `warn` to `debug`. (@wildum)
+
 ### Other changes
 
 - Change the stability of the `livedebugging` feature from "experimental" to "generally available". (@wildum)

docs/sources/reference/components/loki/loki.process.md

@@ -258,6 +258,9 @@ If set to `false`, the `_extracted` suffix will be appended to an already existi
 When `drop_invalid_labels` is set to `true`, the stage drops fields that are not valid label names.
 If set to `false`, the stage will automatically convert them into valid labels replacing invalid characters with underscores.
 
+Only lines that have the key:value format will be extracted. All non-alpha characters in the key are replaced with underscores.
+For example, `\tSecurity ID` will be available in the extracted map as `_Security_ID` to be used in later stages.
+
 #### Example combined with `stage.json`
 
 ```alloy

internal/component/loki/process/stages/eventlogmessage.go

@@ -78,7 +78,7 @@ func (m *eventLogMessageStage) processEntry(extracted map[string]interface{}, ke
 	for _, line := range lines {
 		parts := strings.SplitN(line, ":", 2)
 		if len(parts) < 2 {
-			level.Warn(m.logger).Log("msg", "invalid line parsed from message", "line", line)
+			level.Debug(m.logger).Log("msg", "invalid line parsed from message", "line", line)
 			continue
 		}
 		mkey := parts[0]