A regular expression per line, a column per group
A log file has columns — a time, a level, a message — and no separator anybody agreed on. File ▸ Open with a Pattern reads it into a table anyway: a regular expression describes one line, and each capture group becomes a column. A named group brings its name along as the heading.
^(?<time>\S+ \S+)\s+\[(?<level>[A-Z]+)\]\s+(?<logger>\S+) - (?<message>.*)$A second pattern says which lines count at all — only ERROR|WARN, or everything but DEBUG.
Nothing dropped quietly
Lines the pattern does not describe are counted, and you choose what becomes of them: leave them out, keep them whole in the first column, or add them to the line before — which is what the lines of a stack trace under an error are. The window shows the first two hundred lines as they are beside the table they become, so the pattern is worked out against the real file before anything opens.
A log that is still being written
View ▸ Follow the File as It Grows takes the lines another program writes onto the end into the table as
they arrive, the way tail -f follows a log — only whole lines, through the same filter as the rest, and
with the grid staying at the end if that is where you were reading. For a log of gigabytes, File ▸ Open Part of a
File opens just the last megabytes, or any stretch of it.
Start from a shape that is close
Six patterns come with the app: time-level-message, Apache and Nginx access logs, syslog, whitespace-separated
columns, key: value lines, and anything in brackets. A pattern that took work to get right is saved by
name and travels in the settings file.
