v0.16.0 — Multi-line Records, Row Export, and Session Bundles

v0.16.0 makes complex logs easier to investigate and share. It adds multi-line record parsing, export of the current table view, and portable session bundles.

What's new

Multi-line records

Stack traces, continuation frames, and indented follow-up lines can now be grouped with their original log entry. A Java stack trace, Python traceback, Google glog record, or multi-line logfmt message therefore appears as one row instead of several disconnected lines.

• The complete record is available in the message cell, the Record Details panel, and copied text.
• Eleven built-in regex templates support multi-line records, including Java/Logback, PostgreSQL, Google glog, Rust env_logger, Rails, and Uber Zap.
• Logfmt groups indented continuation lines by default.
• JSON Lines and CSV remain strictly line-based.
• Custom regex templates can use Indented or Until next header continuation modes under Settings → Regex Templates…. Optional header anchors provide faster header detection and are validated before saving.

Multi-line records work in both static files and live streams, including records that cross internal parsing batches.

Export filtered or selected rows (Ctrl+E)

Use File → Export Filtered Rows… to export the current filtered and sorted view. You can export all visible rows or only the selected rows, in the same order shown in the table.

Available formats:

• JSON Lines (.jsonl), preserving native value types and precise UTC timestamps
• CSV (.csv), with RFC 4180 quoting and protection against spreadsheet formula injection
• Source snapshot (.log), preserving the original bytes, including multi-line records
• Markdown table (.md)

Exports run in the background and can be cancelled. Files are written through a temporary file and replaced atomically, so a cancelled or failed export does not leave an incomplete destination file.

Portable session bundles (Ctrl+Shift+E)

Use File → Export Session Bundle… to create a portable .slvbundle containing:

• every retained log row;
• columns, filters, and sort order;
• anchors and notes; and
• highlight rules.

Recipients can open the bundle through File → Open…, drag and drop, the command line, Recent Sessions, or session restore. The investigation view is reconstructed, including remapped anchors.

Bundles use a standard checksummed zstd stream. They can also be unpacked outside the application:

zstd -d bundle.slvbundle -o bundle.jsonl

The resulting JSON Lines file can be inspected with jq or other text-processing tools.

Reliability and platform improvements

• Export writers now use exclusive temporary files, durable flushes, and atomic replacement. Error messages identify common causes such as another application holding the destination file open, insufficient permissions, or interference from antivirus and sync software.
• Windows paths containing non-ASCII characters, such as C:\Users\Jörg\…, now work correctly for exports and decompressed temporary files.
• Bundle detection and validation now handle standard zstd layouts more reliably. Malformed or unsupported bundles produce specific, actionable errors.
• Bundle configuration is applied only to the matching empty session, preventing queued opens from applying the wrong configuration.
• Anchor lookup scales with the number of anchors rather than the number of rows. Ambiguous matches are discarded instead of being attached to the wrong row.
• The glaze dependency was updated from v7.9.1 to v8.0.0, simdjson from v4.6.5 to v4.6.6, and several GitHub Actions dependencies received patch updates.
• The Python-traceback header-anchor benchmark now uses the same best-of-N sampling method as the other hard performance gates, reducing failures caused by host scheduling noise.

Developer notes

• Multi-line handling is shared by the static and streaming parser pipelines. Parsers that do not support continuations retain their existing single-line path.
• The row-export API is Qt-independent and can be reused by the planned headless slv CLI.
• loglib adds public APIs for continuation modes, multi-line record registration, session-bundle writing and reading, cancellation, and bundle validation. Existing LogParser, ParseFile, and streaming-pipeline APIs remain compatible.
• This release adds no new bundled runtime dependencies.

Compatibility

• Existing template and session JSON files continue to load in v0.16.0. New continuationMode, headerAnchor, and multilineLogfmt settings use safe defaults when absent.
• If a configuration saved by v0.16.0 is opened and resaved in v0.15, v0.15 discards the new multi-line template settings and reverts those templates to single-line behaviour. Other session state remains intact.
• .slvbundle is a new v0.16.0 format. For handoff to v0.15, unpack the bundle with zstd and open the resulting .jsonl file.
• Logfmt now groups indented continuation lines by default. Set multilineLogfmt = false in the source dialog's advanced parser options to restore one-row-per-line behaviour.
• New shortcuts: Ctrl+E exports filtered rows, and Ctrl+Shift+E exports a session bundle.

Full changelog: v0.15.0...v0.16.0

v0.15.0 — Triage Faster with Rules, Notes, and Boolean Filters

This release adds four practical ways to keep incident triage organized: reusable row highlighting, notes on anchors, direct navigation, and full boolean filter expressions.

Highlights

• Highlight rules: open Settings → Highlight rules… to color entire rows when a column condition matches. The editor supports text matching, numeric ranges, and booleans, with foreground/background palette choices plus bold and italic. Rules follow columns by stable keys rather than visual position, and the last matching rule wins. Anchor colors remain visually dominant. Rules are saved with both Full and Columns-only configurations.
• Anchor notes: attach a one-line note from an anchored row’s Anchor → Edit note… menu or press F4 on the focused anchored row. Notes can also be edited in the View → Anchors panel by double-clicking its Note cell or pressing F2 while that cell is active. Notes appear in row tooltips and Record Details, are included by Copy as key/value, and are saved with anchor colors.
• Go to Line: choose Edit → Go to Line… (Ctrl+G) and enter a 1-based retained-row number. If streaming retention has evicted older rows, line 1 means the earliest row still retained. A target hidden by filters is reported instead of silently selecting another row.
• Go to Timestamp: choose Edit → Go to Timestamp… (Ctrl+Shift+G) to jump to the first visible row at or after an absolute timestamp or a relative value such as -1h or -30m. Naive timestamps are interpreted in the displayed time zone; timestamps carrying an explicit zone keep that zone.
• Boolean filters: Filters → Advanced Filter… opens a live-validated text editor for nested AND, OR, and NOT expressions. It supports string, regular-expression, wildcard, numeric, boolean, enumeration, and timestamp predicates. The existing simple filter editor remains available and continues to combine its rules with AND.

Compatibility

Anchor notes and highlight rules are additive fields: configurations without them load with empty notes and no highlight rules. Themes from earlier releases also load; the new highlight palette falls back to built-in colors when absent.

Filter persistence is a deliberate schema replacement, not a migration. v0.15.0 removes the old top-level filters array and writes a single expression tree whose leaves identify columns by key. Because unknown JSON keys are tolerated, v0.14 and older configuration files still open, but their old filters array is ignored and those saved filters do not carry forward; the resulting v0.15 view has no active filter expression. Recreate important filters after upgrading, then save from v0.15.

The reverse direction is also lossy: v0.14 does not understand the new expression, highlightRules, or anchor note fields and may drop them when it loads and re-saves a v0.15 configuration. Keep a backup before moving configurations between these versions.

No new bundled runtime dependency is introduced.

Full changelog: v0.14.0...v0.15.0

v0.14.0 — Open Compressed Logs and Spot Activity

Open compressed logs directly, then use two compact visual summaries to find bursts, errors, matches, and anchors across the session.

Highlights

• Transparent compressed-file opening supports gzip (.gz), bzip2 (.bz2), xz (.xz), and Zstandard (.zst) on static open paths: File → Open… (Ctrl+O), drag and drop, command-line file arguments, and session restore. Detection uses file content rather than the extension, and the original compressed path remains the path shown and saved in the session.
• Decompression runs with a progress dialog and Cancel action. In a multi-file open, cancelling or failing one compressed file does not discard files already loaded and does not prevent the remaining queue from continuing.
• View → Histogram (Ctrl+H) opens a bottom dock with time buckets stacked by detected log level. Click a bucket to jump to its first row, drag across buckets to add a time-range filter, use Z / Shift+Z or Ctrl+wheel to change bucket size, and right-click to return to automatic sizing. Anchor ticks remain visible above the chart.
• View → Overview Rail (Ctrl+Shift+R) adds an on-by-default minimap beside the table. It summarizes the currently filtered stream, shows severity density, search-match ticks, anchor bands, and the visible viewport. Click or drag the rail to navigate. Choose Narrow, Medium, or Wide under Settings → Preferences… → Overview rail width.

Persistence and disk use

The histogram’s dock placement, size, and visibility are restored through the application’s saved window state. Overview-rail visibility and width are application preferences. Bucket counts, minimap bins, search ticks, and other derived visualization data are rebuilt from the loaded rows; they are not written into the session or exchanged through an on-disk bucket representation.

Compressed input is decoded into a temporary file in the operating system’s temp directory, then memory-mapped. The temporary file is removed when the associated log mapping is released. A default 32 GiB per-file decompressed-output limit stops decoding after output crosses that threshold. This is a fixed library default in v0.14.0, not a user preference, and it does not reserve space or check available free space in advance: decompression can still fail if the temp volume fills before the limit.

Compatibility

The session JSON schema is unchanged from v0.13.0. Existing sessions continue to load, and a compressed source saves the original compressed-file path so restore decompresses it again. Compressed files are supported only by static opening; live-tail mode and compressed log rotations remain unsupported.

The release adds bundled decompression libraries for the four codecs; their licences are included in the distributed third-party notices.

Full changelog: v0.13.0...v0.14.0

v0.13.0 — Parse Custom Text Logs with Regex Templates

Structured Log Viewer can now turn familiar line-oriented text logs into columns without requiring JSON Lines, logfmt, or CSV. Supply a PCRE2 pattern with named capture groups such as (?<level>...); each named group becomes a column and captured bare values receive the same type detection used by the other parsers.

Highlights

• 28 built-in templates cover common syslog, web-server, database, proxy, cloud, mail, firewall, Java, Rust, Rails, Redis, spdlog, glog, Zap, and container-runtime formats. All 28 are enabled for auto-detection.
• Regex templates are a fourth first-class format alongside JSON Lines, logfmt, and CSV. They work with static files, live file streams, and TCP/UDP network streams, including the existing table, search, filter, sort, anchor, details, and retention features.
• File detection still tries JSON Lines, logfmt, and CSV before regex templates. Regex probing examines at most 16 KiB and eight non-blank lines and requires two full-line matches, reducing accidental one-line matches.
• Open Settings → Regex templates… to create, duplicate, validate, test, save, delete, reload, or reveal user templates. Built-ins are read-only; duplicate one to customize it. User templates are stored under the application data directory in regex_templates/.
• In File → Open Network Stream… (Ctrl+Shift+L), choose Regex template, then select a template or Custom… and enter a PCRE2 pattern. The selected pattern is stored with the session. Files with .log and .txt extensions are also visible in the regular open dialog.

Compatibility

Sessions and configurations from v0.12.0 continue to load. Existing source formats are preserved: a saved JSON, logfmt, or CSV session remains JSON, logfmt, or CSV. The new regexPattern field simply defaults to empty when absent and is ignored for those existing formats; it does not force older logfmt or CSV sessions back to JSON.

The source-format strings already used on disk (json, logfmt, and csv) are unchanged, with regex added as a new value. A regex session saved by v0.13.0 should not be expected to open in v0.12.0, because that build does not recognize the new format value or parser. Existing source-format settings continue to load, while the network-stream dialog adds storage for its regex pattern.

PCRE2 is a new bundled dependency and is listed in the distributed third-party notices. Custom patterns are matched as complete lines and must contain named groups.

Full changelog: v0.12.0...v0.13.0

v0.12.0 — Open and Stream Line-oriented CSV

CSV joins JSON Lines and logfmt as the third format available across files, live tail, and network ingestion. This release is intended for line-oriented, comma-separated logs and exports: it supports common RFC 4180 quoting conventions, but not multiline quoted records.

What’s new

• Open CSV files. Use File → Open… (Ctrl+O) or drag and drop. Each file in a multi-file queue is detected independently, so CSV, JSON Lines, and logfmt can be merged into one table. The file picker now includes *.csv, while content—not the extension—still selects the parser.
• Tail CSV files. Use File → Open Log Stream… (Ctrl+Shift+O). The first non-blank line establishes the column schema, and subsequent lines become records with the same live-tail controls and retention behavior as the other formats.
• Receive CSV over the network. Open File → Open Network Stream… (Ctrl+Shift+L) and choose CSV from Format. The first inbound line becomes the header for the entire session.
• Keep the format with the session. CSV is stored as the csv source-format value, so restored sessions select the same parser automatically.

Accepted CSV

Input is comma-delimited and requires a header on the first non-blank line. CRLF and LF line endings are accepted, and a UTF-8 BOM is stripped when it appears at the start of the header. Quoted cells may contain commas and use "" for a literal quote. Duplicate headers remain addressable: later occurrences are renamed with _2, _3, and so on.

Bare cells share logfmt’s typing rules: empty cells read as null, booleans and decimal numbers receive typed values, and other content stays text. Quoted cells always stay strings, so "42" is not converted to a number. Rows with missing trailing cells expose null values; rows with cells beyond the header width are reported as errors. Auto-detection looks for a plausible header with at least two cells and a following non-blank row with the same cell count.

Important limitations

• This is not strict RFC 4180 support. A quoted cell must open and close on the same physical line. Multiline quoted records are split at newline boundaries and rejected with Unterminated quoted value.
• During live-tail rotation, a replacement file’s header is treated as a data row. Stop and reopen the file to establish the new header correctly.
• With multiple TCP clients, whichever first line arrives first sets the schema for every client. Use identical headers and column order, or restrict CSV sessions to one producer.
• Alternative delimiters and headerless CSV are not supported.

Compatibility

• Existing v0.11.0 sessions continue to load unchanged; source.format simply gains the csv value. No keys are removed or renamed.
• No new keyboard shortcuts are added. The existing networkStream/format preference can now hold csv.
• Public parsing entry points remain stable; the decoder return-type changes are confined to internal headers.
• Packages remain available for Ubuntu 22.04-compatible Linux systems, Windows 10/11, and macOS 12+, with SHA-256 checksums.

Full changelog: v0.11.0...v0.12.0

v0.11.0 — Open and Stream logfmt Logs

Structured Log Viewer can now work with logfmt alongside JSON Lines. The new parser is available everywhere logs enter the app, so the same table, filters, sorting, Find, anchors, Record Details, retention controls, and stream toolbar work with either format.

What’s new

• Open logfmt files directly. Use File → Open… (Ctrl+O) or drag and drop. Format detection is based on content rather than extension, and a multi-file open may mix JSON Lines and logfmt files in one shared table. The picker now includes *.logfmt, *.log, and *.txt; All Files remains available for other names.
• Tail logfmt files. Use File → Open Log Stream… (Ctrl+Shift+O) for a file that is still being written. The detected parser is fixed for that live-tail session and receives the same pause, follow, stop, retention, and rotation behavior as JSON Lines.
• Receive logfmt over the network. Open File → Open Network Stream… (Ctrl+Shift+L) and choose logfmt in the new Format picker. Network data has no file to inspect, so this selection is explicit and is remembered with the session.
• Reopen sessions with the right parser. The source format is saved in session JSON, avoiding a new prompt or a second detection pass when the session is restored.

Accepted logfmt

Each record is one line of whitespace-separated key=value pairs in the Heroku/kr/logfmt style. Values may be double quoted; quoted text supports \", \\, \n, \r, and \t. Unterminated quoted values are reported as parse errors without stopping valid records from loading.

Bare values are typed: an empty value becomes null, true and false become booleans, decimal integers become signed or unsigned integers, and finite decimal/exponent values become doubles. Other values remain strings. Quoting is an intent signal, so pid="42" stays a string. Repeated keys in one record use the last value. logfmt does not provide nested objects.

The standalone log generator also gains --format json|logfmt, making either shape available for generated files and streams.

Compatibility

• JSON Lines remains supported across files, live tail, and network streams; logfmt is an additional parser option. No new keyboard shortcuts or unrelated preference keys are introduced.
• Saved session JSON has an additive schema change: source.format records json or logfmt. Sessions written by v0.10.0 have no format field and therefore default to JSON Lines when loaded. No existing keys are removed or renamed.
• Existing public loglib parsing entry points remain available. Network TLS remains enabled by default in builds that include it.
• Packages remain available for Ubuntu 22.04-compatible Linux systems, Windows 10/11, and macOS 12+, with SHA-256 checksums.

Full changelog: v0.10.0...v0.11.0

v0.10.0 — Faster Triage with Themes and Anchors

This release makes long triage sessions easier to scan and navigate. A new theme system, persistent anchors for file-backed rows, clearer sorting and filtering cues, dockable tools, and a jump-to-tail control turn the viewer into a more discoverable day-to-day workbench.

Highlights

• Themes that follow your environment. Choose Settings → Preferences… → Theme → Active theme. The default, Auto (follow system), switches with the OS light/dark setting. Fifteen built-in themes are included, and Show level icons and High contrast levels can make severity stand out more strongly.
• Editable user themes. Put theme JSON files in the app-data themes folder. Preferences can open that folder, duplicate the active theme as a starting point, or reload edited files without restarting. A user theme with the same name as a built-in takes precedence.
• Eight row-anchor colours. Select rows and press Ctrl+1 through Ctrl+8, or use right-click → Anchor. Remove selected anchors with Ctrl+0; clear all with Ctrl+Shift+A. F2 and Shift+F2 move through visible anchors in the current sorted, filtered, and newest-first order.
• A dockable Anchors panel. Open View → Anchors (Ctrl+K) to see anchored line IDs and source filenames. Double-click or press Enter to jump to an entry. Anchors whose rows are evicted by streaming retention are removed automatically.
• A clearer workbench. The permanent primary toolbar exposes Open, filters, sorting, Find, Record Details, Anchors, and Preferences. Find and Parse Errors are now dockable panels. Filtered column headers show funnel indicators, the status bar reports visible versus total rows, and sorting can be controlled from the Sort menu, toolbar, column-header menu, or header-click cycle.
• Live-tail awareness. When Follow newest is off, a floating “N new lines” control appears as records arrive; selecting it returns to the newest row and resumes following. Ctrl+/ opens the keyboard-shortcuts reference, also shown in the empty table state.

Compatibility

• v0.10.0 still accepts JSON Lines/NDJSON only across static files, live tail, and TCP/UDP network streams.
• Saved configuration/session JSON has an additive on-disk schema change: a top-level anchors array stores file locator, line ID, and colour index. Older files without anchors load with an empty list, and unknown keys remain tolerated. Runtime-only anchors without a stable file locator are not written.
• Existing loglib parser and source entry points remain available. TLS remains enabled by default for network builds unless configured off.
• Appearance preferences move to the Theme controls. Legacy style/font settings are left on disk for downgrade use but are no longer read by v0.10.0. Window geometry, toolbar placement, and dock layout are now remembered.
• Official packages remain available for Ubuntu 22.04-compatible Linux systems (AppImage), Windows 10/11 (ZIP), and macOS 12+ (DMG), each with SHA-256 checksums. The Linux build also fixes an LTO/PIC startup crash.

Full changelog: v0.9.0...v0.10.0

v0.9.1 — Linux AppImage Launch Fix

This Linux AppImage hotfix corrects a startup crash in v0.9.0 caused by mixing PIC and non-PIC static inputs during the IPO/LTO link. The build now enables position-independent code consistently before dependencies are configured.

There are no feature changes from v0.9.0. Windows and macOS packages were not affected by this Linux-specific failure.

Linux users of v0.9.0 should update. See the hotfix PR, the root-cause investigation, or the full patch.

v0.8.1 — Linux AppImage Launch Fix

This Linux AppImage hotfix corrects a startup crash in v0.8.0 caused by mixing PIC and non-PIC static inputs during the IPO/LTO link. The build now enables position-independent code consistently before dependencies are configured.

There are no feature changes from v0.8.0. Windows and macOS packages were not affected by this Linux-specific failure.

Linux users of v0.8.0 should update. See the hotfix PR, the root-cause investigation, or the full patch.

v0.7.1 — Linux AppImage Launch Fix

This Linux AppImage hotfix corrects a startup crash in v0.7.0 caused by mixing PIC and non-PIC static inputs during the IPO/LTO link. The build now enables position-independent code consistently before dependencies are configured.

There are no feature changes from v0.7.0. Windows and macOS packages were not affected by this Linux-specific failure.

Linux users of v0.7.0 should update. See the hotfix PR, the root-cause investigation, or the full patch.