Not highlighting log entries after 5+ entries in logs

[Michael-Stokoe]

I'm having this weird bug that's quite hard to explain so I've recorded my screen to showcase it a bit better.

In as few words as possible though; ideolog stops colouring my log entries after 5+ entries.

Here's the video I recorded (I should have saved as a gif, really)

https://www.youtube.com/watch?v=ZP0Yvi5Rha4

[knah]

In your case it's surprisingly working as currently intended (mostly), though it's somewhat poorly documented.

For logs with 5 lines or less, Ideolog doesn't detect any formats (this is a bug with insufficiently eager format detection). When logs are appended to, Ideolog doesn't re-detect format, so as you paste more lines at the end, it stays unformatted (this is intended, as logs are typically appended to and re-detecting the format of live log would be performance-heavy). Highlighting patterns are applied to individual capture groups in log format. When your log is considered unformatted, whole lines are used as a capture group, and your highlighting patterns match with them. However, once you erase parts of your log when it has more than five lines, Ideolog re-detects the format, picks one of your custom ones, and those have smaller capture groups which individually don't match with your highlighting rules. This currently is intended behavior, although matching highlighting patterns to whole messages is possible.

Currently I'd suggest you to do the following:

• Test on logs with more than five lines
• As you already have a capture group for severity in your format, just use ^ERROR$ as your highlighting pattern - it will match exact contents of severity capture group.