search

tstack / lnav

Log file navigator
http://lnav.org
BSD 2-Clause "Simplified" License
7.73k stars 307 forks source link

Add the ability to add multiple :filter-expr #1252

Open maxim-lbmv opened 5 months ago

maxim-lbmv commented 5 months ago

If you have multiple filters, you can quickly switch between them. For example, I have several applications that generate logs, I can add several filters :filter-expr :log_procname = 'syslogd' to display them all, or quickly disable filters for those that are not currently interesting. Editing one filter every time you need to add or remove messages from the log is not very fast.

Using :filter-in combinations it is difficult to achieve this effect, because you need to filter a specific field, in my case the process name. That is, if I simply write :filter-in syslogd, then the output will include all messages containing syslogd, and not just those generated by the syslogd process.

tstack commented 5 months ago

Support for multiple :filter-exprs introduces a lot of UX issues. Can you provide some suggestions on how the whole flow would work? For example:

maxim-lbmv commented 5 months ago

I think it's better to use the already existing :filter-in and :filter-out logic. Hence the answers to the questions.

How are these separate expressions combined together? Are they OR'd together or AND'd or is the user allowed to combine them arbitrarily?

They must be combined by OR, as happens with other filters

Right now, the :filter-expr command will fill the prompt the current expression. Will that be removed?

Yes, because the command creates a new filter

Does each expression have a name assigned to it by the user so that they can manipulate it?

Names are not needed, control is from the filters panel and the commands :delete-filter, :disable-filter, :enable-filter, etc.