Great article! When I filter for {stream=”stderr”} I see loads of entries from promtail and cilium-agent which rather look like info logs instead of error? Like:

level=info msg="Successful endpoint creation" containerID=359202476e datapathPolicyRevision=57780 desiredPolicyRevision=57780 endpointID=3553 identity=10465 ipv4=x.x.x.x ipv6= k8sPodName=default/name-xxx subsys=daemon

On your last picture it seems the same, many level=info entries. Is this normal? Seems distracting if I’m only looking for errors.