diff --git a/docs/en/observability/logs-stream.asciidoc b/docs/en/observability/logs-stream.asciidoc
index d7c2ff37bd..20e30d2859 100644
--- a/docs/en/observability/logs-stream.asciidoc
+++ b/docs/en/observability/logs-stream.asciidoc
@@ -954,7 +954,7 @@ PUT _ingest/pipeline/logs-example-default
       },
       "reroute": {
         "tag": "high_severity_logs",
-         "if" : "$('log.level', '') == 'WARN' || $('log.level', '') == 'ERROR'",
+        "if" : "ctx.log?.level == 'WARN' || ctx.log?.level == 'ERROR'",
         "dataset": "critical"
       }
     }