Get all warnings and errors from multiple services and one environment
{deployment_environment="production", service_name=~"service1|service2"}
| detected_level =~ "error|warn"{deployment_environment="production", service_name=~"service1|service2"}
| detected_level =~ "error|warn"