Apply filter before adding timestamp?

[ewan-chalmers]

If I run lnav -n -t, instead of lnav -n, then I have to match the generated timestamps in filter expressions. Am I missing something which would allow the filter to apply before the timestamps are inserted, so the same filter could be used?

[tstack]

Can you give some more details/examples. I'm not quite sure what you're asking. Are you filtering based on time?

[ewan-chalmers]

Let's say I have raw log lines which look like this:

Read Cache...
  blah blah not interested
Resource available...
  blah blah not interested

I might filter the lines of interest something like:

:filter-in ^[^ ]+[^\n]+...$

But if I run lnav -t, then the log lines become:

2023-09-06T11:37:44.522  Read Cache...
2023-09-06T11:37:44.522    blah blah not interested
2023-09-06T11:37:44.523  Resource available...
2023-09-06T11:37:44.523    blah blah not interested

Now, to filter the lines of interest I need something like:

:filter-in ^(202[0-9]{1}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}  )?[^ ]+[^\n]+...$

So I need to update the filter to match the generated log lines rather than the input log lines

I'm just curious whether there is a general solution for this that I am missing.

(Clearly, I could have a simpler regex, but I still need to take account of timestamps which may/may not be present, depending on how I run the tool.)

[tstack]

:filter-in ^(202[0-9]{1}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}  )?[^ ]+[^\n]+...$

It looks like you already have a solution since you make the timestamp optional in the regex. Does that regex not work in both cases?

Note that the LOG and TEXT view have different sets of filters. The filter commands will only apply to the current view. You can switch to a view with the :switch-to-view command. Or, you can get even finer control by INSERTing rows into the lnav_view_filters table.

I guess, most times I only filter on a part of the line and not the whole thing, so coming up with a regex to handle both is not something that comes up for me.

One other thing, I'm trying to remove the -t option in the latest release. I've redone a lot of the way lnav consumes input from other programs. For example, the captured input is now spread across multiple files that are rotated. Another change is that the received time and source pipe (i.e. stdout/stderr) are saved as metadata in the file. I didn't think adding the timestamps to the input was particularly useful and I wanted them available all the time without the user needing to think ahead. The main use for the timestamps, for me, was the elapsed time view. So, I've added support for that to the TEXT view (see here). Let me know if this is going to be a problem for you...