Filters

View = a Collection of Filters

At the core of Log Wizard is the concept of a View. The View is just what the name suggests - a filtered subset of the existing log (file) that you are looking at.

A View is a combination of Filters, each yielding some information.

When you open a log for the first time, Log Wizard will create a default view, which initially contains all of the log. You can filter information in a lot of ways. Some are described here

Filters

Filters in a View:

• are matched top-down, and
• the first filter that matches will decide the color of the line (if the filter dictates the full line color)
• the Filters are OR-ed - if any filter matches, the line will be shown in the current View.

Following, I will describe how you can Edit the Filters you've created.

Editing Filters

To Edit the filters in the current View, first make sure the Filter Pane is shown (if it's not shown, toggle it on with Alt-F hotkey).

To add/remove filters, you have the + and - buttons. Each Filter can consist of several lines. Each line can be:

• a condition that needs to match
• extra information about the filter (such as, color or if case-insensitive)
• a comment (starts with #, it's ignored)

In order for the filter to match, all conditions must yield true. So, within a filter, conditions are AND-ed. This also answers the question - what if I want my filters AND-ed? Simple, just make a new filter, and add there all the conditions you want AND-ed.

Condition lines are like this:

• $[part-of-line] [condition] [text] or
• $[part-of-line] [regex]

$[part-of-line] can be any of:

• $level - the category of the message (such as, INFO, DEBUG, ERROR, etc.)
• $msg - the message
• $file - the file where the message was logged from (only if you're logging this)
• $func - the function where the message was logged from (only if you're logging this)
• $class - the class where the message was logged from (only if you're logging this)
• $ctx1, $ctx2, $ctx3 - extra context (depending on your log, you can decide to log extra information, such as - the module where the message is coming from)

[condition] is any of:

• = - matches if it's equal to the given text
• != - matches if it's not equal to the given text
• startswith - matches if it starts with the given text
• !startswith - matches if it doesn't start with the given text
• contains - matches if it contains the given text
• !contains - matches if it doesn't contain the given text
• any - matches if the text contains any of the subexpressions in the given text. Each subexpression is - separated by "|". Example: $msg any Kaspersky|Norton|Avg
• none - matches if the text contains none of the subexpressions in the given text. Each subexpression is separated by "|". Example: $msg none Kaspersky|Norton|Avg

Extra information lines:

• color fg [bg]
• match_color fg [bg]
• case-insensitive

The color line specifies what color to apply if the filter matches. The colors are in the #RRGGBB syntax, and some of the known colors are recognized. So you can say things like color red, match_color darkred, color #ee0022.

If you specify color, all line will be colored. If you specify match_color, only what is matched is matched is colored. You can specify both color and match_color.

Example:

$msg contains settings
match_color blue
color green

This will match all lines containing the word settings. Each such line will be written with green, however, the word settings will be written in bold and with blue.

By default, the filter is case-sensitive. If you want it to be case-insensitive, just add a line saying case-insensitive.

Example:

case-insensitive
$msg contains kaspersky
$msg startswith process
color green

This will create a case-insensitive filter that matches all lines that start with process and contain kaspersky. It will show all lines matching it in green color.

Finally, I added two more buttons: ToC / FromC (= To Clipboard / From Clipboard). ToC will copy ALL the filters from the current View to clipboard, and FromC will paste them. Say you have a colleague and you want to "send him" your current View - copy it to clipboard, send it to him. He'll paste it and voila - he's got the same View as yours!