tstack / lnav

Log file navigator
http://lnav.org
BSD 2-Clause "Simplified" License
7.23k stars 295 forks source link

support for multiple JSON line-formats and switching between them #1274

Open tstack opened 1 month ago

tstack commented 1 month ago

From a comment on this post -- https://news.ycombinator.com/item?id=40718862

I do wish there was support for switching formats so I could switch between different "views" over the same data, maybe it will be possible someday :)

vagran commented 1 month ago

My case is that I am unable to make my format to be selected. It is actually pino format. I tried to add my custom format, like this:

{
    "$schema": "https://lnav.org/schemas/format-v1.schema.json",
    "pino_log": {
        "title": "Pino log",
        "json": true,
        "line-format": [
            {
                "field": "time"
            },
            " ",
            {
                "field": "__level__",
                "text-transform": "uppercase",
                "auto-width": true
            },
            " ",
            {
                "field": "msg"
            }
        ],
        "level-field": "level",
        "level": {
            "fatal": 60,
            "error": 50,
            "warning": 40,
            "info": 30,
            "debug": 20,
            "trace": 10
        },
        "value": {
            "hostname": {
                "kind": "string",
                "identifier": true,
                "hidden": true
            },
            "time": {
                "kind": "integer",
                "identifier": false
            },
            "pid": {
                "kind": "integer",
                "identifier": false
            },
            "level": {
                "kind": "integer",
                "identifier": true,
                "foreign-key": true
            },
            "msg": {
                "kind": "string"
            }
        },
        "timestamp-field": "time",
        "body-field": "msg"
    }
}

but lnav keeps selecting bunyan_log instead. I do not need all fields from bunyan_log line format. But the worst thing is that time is interpreted incorrectly. Bunyay has string kind specified, I have specified integer, but is still selects bunyan. This, by the way, sounds like a bug. Also if it would select my format, how can I specify that this is UTC milliseconds? And I want to display them in UTC.

Here is log example:

{"level":30,"time":1719324213672,"pid":3191448,"hostname":"RaspberryNode","msg":"message here"}