diff --git a/docker/ingestor/core.toml b/docker/ingestor/core.toml
index 7d0784c4..dece4ec7 100644
--- a/docker/ingestor/core.toml
+++ b/docker/ingestor/core.toml
@@ -403,7 +403,6 @@ if .hdx_platform == "vector-internal" {
       .b.timestamp = tmp_timestamp
 
       .h = .b.host
-      .st = downcase(.b.level) ?? null
       .sv = .b."service.name"
       .ts = to_unix_timestamp(from_unix_timestamp(.b.timestamp, unit: "milliseconds") ?? now(), unit: "nanoseconds")
       .b._hdx_body = .b.message
@@ -412,6 +411,9 @@ if .hdx_platform == "vector-internal" {
         .b = merge(.b, structured, deep: true) ?? .b
       }
 
+      # set severity after merging structured message (to avoid conflict)
+      .st = downcase(.b.level) ?? null
+
       if exists(.b."rr-web.event") {
         .hdx_platform = "rrweb"
         temp_msg = .b.message
@@ -479,6 +481,11 @@ if is_object(.b) {
     .st = downcase(.b.level) ?? downcase(.b.severity) ?? downcase(.b.LEVEL) ?? downcase(.b.SEVERITY) ?? null
   }
 
+  # address .b.level and .st conflict
+  if !is_nullish(.b.level) && .b.level != .st {
+    .b.level = .st
+  }
+
   # merge vercel logs
   if is_object(.__hdx_logs) {
     tmp_b_size = strlen(encode_json(.b))