in production code, what's the log level when failing to validate request parameters or format

as titled. in production code, what's the log level when failing to validate request parameters or format ?

I confuse this puzzle base on two points:

(1) if I log it to error. I concern if one hacker to send too many error requests will cause our APP log two many error log.

(2) but if I log it to debug or lower levels. I concern I can't track issue effectively due to in production app, log will be setted to warn.

So what's my choose?