Logview major mode for Emacs provides syntax highlighting, filtering and other features for various log files. The main target are files similar to ones generated by Log4j, Logback and other Java logging libraries, but there is really nothing Java-specific in the mode and it should work just fine with any log that follows similar structure, probably after some configuration.
The mode is meant to be operated in read-only buffer, so all the command bindings lack modifiers.
Out-of-the-box the mode should be able to parse standard SLF4J (Log4j,
Logback) files as long as they use ISO 8601 timestamps and certain
UNIX files in /var/log.
Logview is available from MELPA (both
stable and
unstable). Assuming your
package-archives lists MELPA, just type
M-x package-install RET logview RET
to install it.
Alternatively, installing Logview from source is not difficult either. First, clone the source code:
$ cd SOME-PATH
$ git clone https://github.com/doublep/logview.git
Now, from Emacs execute:
M-x package-install-file RET SOME-PATH/logview
Alternatively to the second step, add this to your .emacs file:
(add-to-list 'load-path "SOME-PATH/logview")
(require 'logview)
Since there is no standard log file format, Logview mode has to try and guess how the log file it operates on is formatted. It does so by trying to parse the very first line of the file against various submodes it has.
If it succeeds in guessing, you will see major mode specifed as ‘Logview/...’ in the modeline, where the second part is the submode name.
In case it fails, you will see it complain in the echo area. The buffer will also not be highlighted or switched to read-only mode, so you will be able to edit it.
Currently your only option is to customize the mode. C-c C-s will
show you only those options that are relevant to submode guessing.
You will need to customize at least one of those, or maybe all three.
All the variables are well-documented in customization interface.
If you think your log format is standard enough, you can open an issue and request format addition to the list of mode built-ins.
Nearly all commands have some use for prefix argument. It can be usually just guessed, but you can always check individual command documentation within Emacs.
When buffer is switched to read-write mode, Logview automatically deactivates all its commands so as to not interfere with editing. Once you switch the buffer back to read-only mode, commands will be active again.
- All standard Emacs commands
- Move to the beginning of entry’s message:
TAB - Move to next / previous entry:
n/p - Move to next / previous ‘as important’ [*] entry:
N/P - Move to first / last entry:
</>
[*] ‘As important’ means entries with the same or higher level. For example, if the current entry is a warning, ‘as important’ include errors and warnings.
- Narrow from / up to the current entry:
[/] - Widen:
w - Widen upwards / downwards only:
{/}
- Show only errors:
l 1orl e - Show errors and warnings:
l 2orl w - Show errors, warnings and information:
l 3orl i - Show all levels except trace:
l 4orl d - Show entries of all levels:
l 5orl t - Show entries ‘as important’ as the current one:
+orl +
See more detailed description below.
- Edit current name, thread and message filters:
f(pops up a separate buffer) - Add name include / exclude filter:
a/A - Add thread include / exclude filter:
t/T - Add message include / exclude filter:
m/M
- Reset level filter:
r l - Reset name filters:
r a - Reset thread filters:
r t - Reset message filters:
r m - Reset all filters:
R - Reset all filters, widen and show all explicitly hidden entries:
r e
See more detailed description below.
- Switch to a view:
v - Save the current filters as a view for this submode:
V s - Save the current filters as a global view:
V S - Edit submode views:
V e(pops up a separate buffer) - Edit all views:
V E(pops up a separate buffer) - Delete a view by name:
V d
- Hide one entry:
h - Hide entries in the region:
H - Show some explicitly hidden entries:
s - Show explicitly hidden entries in the region:
S
In Transient Mark mode h and s operate on region when mark is
active.
The mode terms all message lines after the first ‘details’. Oftentimes these contain exception stacktrace, but most logging libraries let you write anything here.
- Toggle details of the current entry:
d - Toggle details of all entries in the region:
D - Toggle details in the whole buffer:
e
In Transient Mark mode d operates on region when mark is active.
These options can be customized globally and additionally temporarily changed in each individual buffer.
- Toggle Auto-Revert mode:
o r - Toggle Auto-Revert Tail mode:
o t - Toggle ‘copy only visible text’:
o v - Toggle ‘search only in messages’:
o m - Toggle ‘show ellipses’:
o e
- Customize options that affect submode selection:
o SorC-c C-s - Bury buffer:
q - Refresh the buffer (appending, if possible) preserving active filters:
g - Append log file tail to the buffer:
x - Revert the buffer preserving active filters:
X - Universal prefix commands are bound without modifiers:
u,-,0..9
In addition to level filtering, Logview supports filtering by entry’s logger name, thread and message.
These filters are regular expression and come in two kinds: include and exclude filters. If at least one include filter is set, only those entries where relevant part matches at least one of regular expressions are shown, all others are filtered out. If any exclude filter is set, all entries where relevant part matches its regular expression are filtered out (regardless of any other filters) and hidden.
Easiest way to add filters is by using a / A commands (add
include/exclude name filter correspondingly), t / T (thread
filters), and m / M (message filters). You can reset all filters
of given type: r a for name, r t for thread and r m for message
filters, R for all filters at once.
However, oftentimes you need to adjust existing filters, e.g. to fix a
typo or simply change one, while keeping others the same. For this
purpose use f command. It pops up a separate buffer with all
currently active filters, which you can edit as you like, using any
standard Emacs features.
Lines beginning with ‘#’ character are comments. They and empty lines
are ignored. Lines for actual filters must start with certain prefix:
‘a+ ’ (note the single trailing space!) for name inclusion filters,
‘a- ’ for name exclusion, and similart ‘t+ ’, ‘t- ’, ‘m+ ’, ‘m- ’ for
thread and message filters. Additionally, multiline message filters
must use ‘.. ’ prefix (two dots and a space) for continuation lines.
The buffer mode has some syntax highlighting support, so you should
see if anything goes wrong. The easiest way to figure it out is to
add a few filters using commands described earlier and then open this
buffer with f and see how they are represented.
Regular expressions can be matched against entry parts either
case-sensitively or case-insensitively, depending on standard Emacs
variable case-fold-search.
Filters are matched against relevant entry parts as strings, not
against the whole buffer. Therefore, you can use ^ and $ special
characters for the expected meaning. For example, adding ^org as
name exclusion filter will hide all entries where logger name begins
with string ‘org’.
Unlike name and thread filters, message filters can span multiple
lines. To enter linefeed in message buffer (after m or M) use
C-q C-j. When editing a multiline filter with f, prefix all
continuation lines with ‘.. ’.
Commands a, A, t and T default to the name (or thread) of the
current entry. You can also use C-p (<up>) to browse history of
previously entered values and C-n (<down>) for a few default
values.
Views are named sets of filters that you can activate quickly. They are especially useful if you use name or message filters a lot, and often find yourself typing in the same filters over and over again.
The easiest way to define a view is by first adding all the filters
you need. This way you can see in the buffer if the filtering result
matches what you expect. After you are satisfied, type V s and a
name for the new view. Notice that the mode line now displays name of
the view in square brackets after the submode name, e.g.:
Logview/SLF4J [useful-view-1]
Now type R to reset all the filters. All previously hidden entries
will be shown again and the view name disappear from the mode line.
However, to restore the filters now you don’t have to re-create them
one-by-one. Simply type v and whatever name you used when saving
your first view. You can also use text completion to pick among all
the defined views.
Remember that further filtering doesn’t affect view definition. If
you want to change a view, save filters as a view with the same name
again, and confirm that you do want to replace the previous
definition. Alternative way is to edit views using V e. This pops
up a separate buffer just like f command does, but instead of
filters you will edit all defined views for the current submode at
once. This way you can change existing definitions, delete unneeded
or add more. Commands like V s or V d (delete a view by name) can
be seen as just a convenience.
Views come in two kinds: globally accessible and bound to a specific
submode. This distinction is important if you use logs of different
kinds. Most often you need submode-specific views, because text
filters usually can’t be meaningfully applied without changes to
different programs. When you use v command, only the views for the
current submode plus any global views are available for selection.