Mezmo Sink: Log level/severity is not included

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

The level of the log is not included in /src/sinks/mezmo.rs. If I try to put a .level = "info" or ._level = "info" in a transform, it gets put into the meta object by the Mezmo sink.

What should be sent like:

{
  "lines": [
    {
      "line": "I am a warning",
      "app": "my-app",
      "level": "warning",
      "meta": {
        "subject": ["script"]
      }
    }
  ]
}

instead sends as:

{
  "lines": [
    {
      "line": "I am a warning",
      "app": "my-app",
      "meta": {
        "level": "warning",
        "subject": ["script"]
      }
    }
  ]
}

Because the level is in the meta object, the severity is not shown in the live tail and isn't filtered correctly (it's treated as if it has no level/severity. As a workaround, I am using encode_json like this:

payload = {
  "level": .level,
  "message": .message,
  "subject": .subject,
  "src_ip": .host
}
.message = encode_json(payload)

Configuration

Version

vector 0.57.0 (x86_64-unknown-linux-gnu 8832452 2026-07-14 20:58:30.491174540)

Debug Output

Example Data

No response

Additional Context

No response

References

No response

Start in src/sinks/mezmo.rs and compare the current payload with the expected JSON in the issue. Trace how the log level is handled versus other fields, then verify that a configured level is emitted as the top-level line level rather than inside meta; the resulting Mezmo payload should match the expected structure.