Add Column-Aware Analyzer with actionable insights and advanced filtering

Major features:
- Column-Aware Analyzer that detects structured log formats
  - Automatic column detection from headers
  - Per-column statistics with bar charts
  - 4 actionable insights: Noise Detection, Error Groups, Anomalies, Filter Suggestions
  - One-click filter application with undo support

- Advanced Conditional Filter (Rule Builder)
  - AND/OR group operators
  - Rule types: contains, not contains, level, regex
  - Visual UI for building complex filter expressions

- Time Gap Detection
  - Configurable gap threshold
  - Pattern/line range filtering
  - Next/prev navigation with position indicator
  - European timestamp format support (DD.MM.YYYY)

- Highlight Navigation
  - Next/prev buttons for each highlight color
  - On-demand search with caching
  - Position indicator

UI improvements:
- Distinct scrollbar colors for sidebar sections
- Click-to-navigate for insights (errors, anomalies)
- Active filter indicator with clear button

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: ozgesolidkey

src/main/analyzers/columnAwareAnalyzer.ts

@@ -50,6 +50,7 @@ interface LogCluster {
   template: string[];        // The log template (tokens with <*> for variables)
   count: number;             // Number of logs matching this pattern
   sampleLines: number[];     // Sample line numbers
+  sampleText?: string;       // First sample log line for display
   level?: string;            // Detected log level
 }
 
@@ -220,7 +221,7 @@ export class DrainAnalyzer implements LogAnalyzer {
         if (this.clusterCount < MAX_CLUSTERS) {
           const tokens = tokenize(trimmed);
           if (tokens.length > 0 && tokens.length < 100) {
-            this.addLogMessage(tokens, lineNumber, level);
+            this.addLogMessage(tokens, lineNumber, level, trimmed);
           }
         }
 
@@ -253,13 +254,22 @@ export class DrainAnalyzer implements LogAnalyzer {
     // Build pattern groups
     const patterns: PatternGroup[] = allClusters
       .filter(c => c.count > 1)
-      .map(cluster => ({
-        pattern: cluster.template.join(' '),
-        template: cluster.template.join(' '),
-        count: cluster.count,
-        sampleLines: cluster.sampleLines.slice(0, 5),
-        category: categorizePattern(cluster.template, cluster.level)
-      }))
+      .map(cluster => {
+        // Create human-readable template: extract key fixed tokens
+        const keyTokens = cluster.template.filter(t => t !== PARAM_TOKEN && t.length > 2);
+        const readableTemplate = keyTokens.length > 0
+          ? keyTokens.slice(0, 8).join(' ')  // Show up to 8 key tokens
+          : cluster.template.slice(0, 5).join(' ');
+
+        return {
+          pattern: cluster.template.join(' '),
+          template: readableTemplate,
+          count: cluster.count,
+          sampleLines: cluster.sampleLines.slice(0, 5),
+          sampleText: cluster.sampleText,
+          category: categorizePattern(cluster.template, cluster.level)
+        };
+      })
       .sort((a, b) => b.count - a.count)
       .slice(0, maxPatterns);
 
@@ -303,7 +313,7 @@ export class DrainAnalyzer implements LogAnalyzer {
     };
   }
 
-  private addLogMessage(tokens: string[], lineNumber: number, level?: string): void {
+  private addLogMessage(tokens: string[], lineNumber: number, level?: string, originalLine?: string): void {
     const len = tokens.length;
 
     // Get or create length bucket
@@ -357,10 +367,14 @@ export class DrainAnalyzer implements LogAnalyzer {
       }
     } else {
       // Create new cluster
+      const sampleText = originalLine
+        ? (originalLine.length > 150 ? originalLine.substring(0, 150) + '...' : originalLine)
+        : undefined;
       const newCluster: LogCluster = {
         template: tokens.map(t => isVariable(t) ? PARAM_TOKEN : t),
         count: 1,
         sampleLines: [lineNumber],
+        sampleText,
         level
       };
       node.clusters.push(newCluster);

src/main/analyzers/drainAnalyzer.ts

@@ -3,12 +3,15 @@ export * from './types';
 export { analyzerRegistry } from './registry';
 export { RuleBasedAnalyzer } from './ruleBasedAnalyzer';
 export { DrainAnalyzer } from './drainAnalyzer';
+export { ColumnAwareAnalyzer } from './columnAwareAnalyzer';
 
 // Register built-in analyzers
 import { analyzerRegistry } from './registry';
 import { DrainAnalyzer } from './drainAnalyzer';
 import { RuleBasedAnalyzer } from './ruleBasedAnalyzer';
+import { ColumnAwareAnalyzer } from './columnAwareAnalyzer';
 
-// Drain is the default (registered first) - better pattern discovery
+// Column-aware is the default (registered first) - best for structured logs
+analyzerRegistry.register(new ColumnAwareAnalyzer());
 analyzerRegistry.register(new DrainAnalyzer());
 analyzerRegistry.register(new RuleBasedAnalyzer());

src/main/analyzers/index.ts

@@ -18,6 +18,7 @@ export interface PatternGroup {
   template: string;     // Human-readable template with {placeholders}
   count: number;
   sampleLines: number[];
+  sampleText?: string;  // Actual example log line
   category: 'noise' | 'error' | 'warning' | 'info' | 'debug' | 'unknown';
 }
 
@@ -28,6 +29,71 @@ export interface DuplicateGroup {
   lineNumbers: number[];
 }
 
+export interface ColumnStatValue {
+  value: string;
+  count: number;
+  percentage: number;
+}
+
+export interface ColumnStats {
+  name: string;
+  type: string;
+  topValues: ColumnStatValue[];
+  uniqueCount: number;
+}
+
+// Noise candidate - high frequency message that could be filtered
+export interface NoiseCandidate {
+  pattern: string;
+  sampleText: string;
+  count: number;
+  percentage: number;
+  channel?: string;
+  suggestedFilter: string;
+}
+
+// Grouped error/warning messages
+export interface ErrorGroup {
+  pattern: string;
+  sampleText: string;
+  count: number;
+  level: 'error' | 'warning';
+  channel?: string;
+  firstLine: number;
+  lastLine: number;
+}
+
+// Rare/anomalous message
+export interface Anomaly {
+  text: string;
+  lineNumber: number;
+  level?: string;
+  channel?: string;
+  reason: string; // Why it's considered anomalous
+}
+
+// Filter suggestion
+export interface FilterSuggestion {
+  id: string;
+  title: string;
+  description: string;
+  type: 'exclude' | 'include' | 'level';
+  filter: {
+    excludePatterns?: string[];
+    includePatterns?: string[];
+    levels?: string[];
+    channel?: string;
+  };
+}
+
+// Analysis insights - the useful stuff
+export interface AnalysisInsights {
+  noiseCandidates: NoiseCandidate[];
+  errorGroups: ErrorGroup[];
+  anomalies: Anomaly[];
+  filterSuggestions: FilterSuggestion[];
+}
+
 export interface AnalysisResult {
   stats: {
     totalLines: number;
@@ -41,6 +107,8 @@ export interface AnalysisResult {
   timeRange?: { start: string; end: string };
   analyzerName: string;
   analyzedAt: number;
+  columnStats?: ColumnStats[];
+  insights?: AnalysisInsights;
 }
 
 // Base interface - all analyzers must implement this