diff --git a/charts/osm/templates/fluentbit-configmap.yaml b/charts/osm/templates/fluentbit-configmap.yaml
index 620ea25606..fed096fc91 100644
--- a/charts/osm/templates/fluentbit-configmap.yaml
+++ b/charts/osm/templates/fluentbit-configmap.yaml
@@ -19,7 +19,7 @@ data:
     [FILTER]
       name       grep
       match      *
-      regex      $message['level'] error
+      regex       message /"level":"error"/
     [OUTPUT]
       Name    stdout
       Match   *
diff --git a/docs/patterns/observability/logs.md b/docs/patterns/observability/logs.md
index 557e8e33b4..4916de7cf8 100644
--- a/docs/patterns/observability/logs.md
+++ b/docs/patterns/observability/logs.md
@@ -21,7 +21,7 @@ You may configure log forwarding to an output by following these steps _before_
    [FILTER]
          name       grep
          match      *
-         regex      $message['level'] error
+         regex      message /"level":"error"/
    ```
 
 4. Once you have updated the Fluent Bit configmap, you can deploy the sidecar during OSM installation using the `--enable-fluentbit` flag. You should now be able to interact with error logs in the output of your choice as they get generated.