Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature request: hide/show "discovered fields" #1272

Open
ian-h-chamberlain opened this issue Jun 13, 2024 · 0 comments
Open

Feature request: hide/show "discovered fields" #1272

ian-h-chamberlain opened this issue Jun 13, 2024 · 0 comments
Labels
enhancement Feature Request

Comments

@ian-h-chamberlain
Copy link
Sponsor

Is your feature request related to a problem? Please describe.
:hide-fields is handy for showing only the information I really care about, and the newer selection dialog in p makes it even easier to toggle fields at will, thank you! However I tend to look at a bunch of different logs that I don't necessarily have formats defined for, and so the functionality of hiding fields is rather limited when using generic_log, since many of the log fields won't actually be hideable. For example, some dmesg output: (a bit contrived, but I think illustrates my point):

[1970-11-02 17:31:40.428006] eth0: renamed from veth8afa44f
[1970-11-02 17:31:40.444429] IPv6: ADDRCONF(NETDEV_CHANGE): veth0567f8f: link becomes ready
[1970-11-02 17:31:40.446570] docker0: port 1(veth0567f8f) entered blocking state
[1970-11-02 17:31:40.448467] docker0: port 1(veth0567f8f) entered forwarding state
[1970-11-02 17:32:55.151778] veth8afa44f: renamed from eth0
[1970-11-02 17:32:55.162453] docker0: port 1(veth0567f8f) entered disabled state
[1970-11-02 17:32:55.189350] docker0: port 1(veth0567f8f) entered disabled state
[1970-11-02 17:32:55.197691] device veth0567f8f left promiscuous mode
 Received Time: 1970-11-02T17:32:55.197 — over 53 years ago  Format: %s.%f
 Pattern: builtin (8) = ^(?:\*\*\*\s+)?\[(?<timestamp>[\w: \.,+/-]+)\]\s*(\w+):?
 Known message fields for table generic_log:
 | ◆ 📊 log_time = 26433175.197691
 Discovered fields for logline table from message format: ] device # left promiscuous mode
   col_0 = veth0567f8f
[1970-11-02 17:32:55.199287] docker0: port 1(veth0567f8f) entered disabled state
[1970-11-02 17:33:08.526417] docker0: port 1(vethef4c1c6) entered blocking state
[1970-11-02 17:33:08.534106] docker0: port 1(vethef4c1c6) entered disabled state
[1970-11-02 17:33:08.540413] device vethef4c1c6 entered promiscuous mode

Describe the solution you'd like
It would be great to be e.g. :hide-fields col_0 the same way known fields can be hidden. Similarly, toggling with SPC in the details panel would be nice. I realize that for some log formats, this may end up with inconsistent results between different lines (since column 0 may have different meaning / be missing from some lines), but for cases where nearly every line has the same fields, it would be really nice to hide some.

Describe alternatives you've considered
Of course it's possible to write a log format to capture the fields, making them "known", and hide that way — but for one-off logs the effort required doesn't feel worth it.

It's also possible to write a query in SQL that would show just the fields I want, e.g. ; SELECT log_time, col_1, col_2 FROM logline. This is a bit cumbersome when all I'm really looking to do is hide one or two fields (sometimes there are 8-10 fields I do want), and also doesn't display quite as nicely as the standard view (highlighting etc.)

Additional context
Let me know if you think this request makes sense! Since the query language already sorta supports this, hopefully it wouldn't be too difficult to implement.

@ian-h-chamberlain ian-h-chamberlain added the enhancement Feature Request label Jun 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Feature Request
Projects
None yet
Development

No branches or pull requests

1 participant