You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe. :hide-fields is handy for showing only the information I really care about, and the newer selection dialog in p makes it even easier to toggle fields at will, thank you! However I tend to look at a bunch of different logs that I don't necessarily have formats defined for, and so the functionality of hiding fields is rather limited when using generic_log, since many of the log fields won't actually be hideable. For example, some dmesg output: (a bit contrived, but I think illustrates my point):
[1970-11-02 17:31:40.428006] eth0: renamed from veth8afa44f
[1970-11-02 17:31:40.444429] IPv6: ADDRCONF(NETDEV_CHANGE): veth0567f8f: link becomes ready
[1970-11-02 17:31:40.446570] docker0: port 1(veth0567f8f) entered blocking state
[1970-11-02 17:31:40.448467] docker0: port 1(veth0567f8f) entered forwarding state
[1970-11-02 17:32:55.151778] veth8afa44f: renamed from eth0
[1970-11-02 17:32:55.162453] docker0: port 1(veth0567f8f) entered disabled state
[1970-11-02 17:32:55.189350] docker0: port 1(veth0567f8f) entered disabled state
[1970-11-02 17:32:55.197691] device veth0567f8f left promiscuous mode
Received Time: 1970-11-02T17:32:55.197 — over 53 years ago Format: %s.%f
Pattern: builtin (8) = ^(?:\*\*\*\s+)?\[(?<timestamp>[\w: \.,+/-]+)\]\s*(\w+):?
Known message fields for table generic_log:
| ◆ 📊 log_time = 26433175.197691
Discovered fields for logline table from message format: ] device # left promiscuous mode
col_0 = veth0567f8f
[1970-11-02 17:32:55.199287] docker0: port 1(veth0567f8f) entered disabled state
[1970-11-02 17:33:08.526417] docker0: port 1(vethef4c1c6) entered blocking state
[1970-11-02 17:33:08.534106] docker0: port 1(vethef4c1c6) entered disabled state
[1970-11-02 17:33:08.540413] device vethef4c1c6 entered promiscuous mode
Describe the solution you'd like
It would be great to be e.g. :hide-fields col_0 the same way known fields can be hidden. Similarly, toggling with SPC in the details panel would be nice. I realize that for some log formats, this may end up with inconsistent results between different lines (since column 0 may have different meaning / be missing from some lines), but for cases where nearly every line has the same fields, it would be really nice to hide some.
Describe alternatives you've considered
Of course it's possible to write a log format to capture the fields, making them "known", and hide that way — but for one-off logs the effort required doesn't feel worth it.
It's also possible to write a query in SQL that would show just the fields I want, e.g. ; SELECT log_time, col_1, col_2 FROM logline. This is a bit cumbersome when all I'm really looking to do is hide one or two fields (sometimes there are 8-10 fields I do want), and also doesn't display quite as nicely as the standard view (highlighting etc.)
Additional context
Let me know if you think this request makes sense! Since the query language already sorta supports this, hopefully it wouldn't be too difficult to implement.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
:hide-fields
is handy for showing only the information I really care about, and the newer selection dialog inp
makes it even easier to toggle fields at will, thank you! However I tend to look at a bunch of different logs that I don't necessarily have formats defined for, and so the functionality of hiding fields is rather limited when usinggeneric_log
, since many of the log fields won't actually be hideable. For example, somedmesg
output: (a bit contrived, but I think illustrates my point):Describe the solution you'd like
It would be great to be e.g.
:hide-fields col_0
the same way known fields can be hidden. Similarly, toggling with SPC in the details panel would be nice. I realize that for some log formats, this may end up with inconsistent results between different lines (since column 0 may have different meaning / be missing from some lines), but for cases where nearly every line has the same fields, it would be really nice to hide some.Describe alternatives you've considered
Of course it's possible to write a log format to capture the fields, making them "known", and hide that way — but for one-off logs the effort required doesn't feel worth it.
It's also possible to write a query in SQL that would show just the fields I want, e.g.
; SELECT log_time, col_1, col_2 FROM logline
. This is a bit cumbersome when all I'm really looking to do is hide one or two fields (sometimes there are 8-10 fields I do want), and also doesn't display quite as nicely as the standard view (highlighting etc.)Additional context
Let me know if you think this request makes sense! Since the query language already sorta supports this, hopefully it wouldn't be too difficult to implement.
The text was updated successfully, but these errors were encountered: