diff --git a/config/services/systemd/common/alloy/config.alloy.j2 b/config/services/systemd/common/alloy/config.alloy.j2
index 3f9edf8..aac0cc7 100644
--- a/config/services/systemd/common/alloy/config.alloy.j2
+++ b/config/services/systemd/common/alloy/config.alloy.j2
@@ -204,6 +204,11 @@ loki.process "journal_parser" {
         forward_to = [loki.write.loki.receiver]
         // Severity parsing
         // If content of log includes "level" information, change the level
+        stage.json {
+            expressions = {
+                "content_level" = "level",
+            }
+        }
         stage.logfmt {
             mapping = {
                 "content_level" = "level",