@@ -14,25 +14,26 @@ You no longer need to manually correlate timestamps across multiple windows or
1414figure out the order in which to view rotated log files. The color bars on the
1515left-hand side help to show which file a message belongs to.
1616
17- ![ Screenshot of lnav showing messages from multiple files] ( /assets/images/lnav-multi-file2.png )
17+ ![ Screenshot of lnav showing messages from multiple files] ( /assets/images/lnav-multi-file2.svg )
1818
1919## Automatic Log Format Detection
2020
2121The log message format is automatically determined by lnav while scanning your
22- files. The following are some of the [ formats that are built in by default] ( https://docs.lnav.org/en/latest/formats.html ) :
22+ files. Over 70 [ formats are built in by default] ( https://docs.lnav.org/en/latest/formats.html ) ,
23+ including:
2324
2425* Common Web Access Log format
2526* W3C Extended Log File Format
2627* logfmt
27- * CUPS page_log
28- * Syslog
29- * Glog
28+ * Syslog, Glog, dpkg.log, journald (JSON)
29+ * CUPS page_log, uwsgi, Caddy
30+ * Cloudflare Enterprise access logs
31+ * OpenTelemetry Collector, OTLP Python
32+ * Rust tracing, Bunyan, Pino
3033* VMware ESXi/vCenter Logs
31- * dpkg.log
32- * uwsgi
34+ * MongoDB, MySQL (error/general/slow), PostgreSQL
3335* "Generic" - Any message that starts with a timestamp
34- * Strace
35- * sudo
36+ * Strace, sudo (via syslog)
3637
3738If your log file format is JSON-lines or can be matched by a PCRE regular
3839expression, you can define your own format in a
@@ -45,15 +46,30 @@ GZIP'ed and BZIP2'ed files are also detected automatically and decompressed on-t
4546Display only lines that match or do not match a set of regular expressions.
4647Useful for removing extraneous log lines that you are not interested in.
4748
48- ## Timeline View
49+ ## Histogram View
4950
50- The timeline view shows a histogram of messages over time. The number of
51+ The histogram view shows a bucketed count of messages over time. The number of
5152warnings and errors are highlighted in the display so that you can easily see
52- where problems have occurred. Once you have found a period of time that is of
53+ where problems have occurred. Once you have found a period of time that is of
5354interest, a key-press will take you back to the log message view at the
5455corresponding time.
5556
56- ![ Screenshot of timeline view] ( /assets/images/lnav-hist.png )
57+ ![ Screenshot of the histogram view showing message counts over time] ( /assets/images/lnav-hist.svg )
58+
59+ ## Timeline View
60+
61+ The timeline view visualizes operations across time. Each row corresponds to
62+ an operation identifier (an opid from the log messages), a thread, a tag, or a
63+ log file, and a colored bar shows the time span the operation covers.
64+ Sub-operations and per-operation error/warning sparklines make it easy to see
65+ where problems have clustered and how operations overlap.
66+
67+ The timeline works with any log format that defines an ` opid-field ` (for
68+ example, ` cloudflare_json_log ` , ` rust_tracing_log ` , ` otel_collector_log ` ) or
69+ that supplies an opid-description so that related messages can be grouped
70+ automatically.
71+
72+ ![ Screenshot of the timeline view showing operations over time] ( /assets/images/lnav-timeline.svg )
5773
5874## Pretty-Print View
5975
@@ -63,11 +79,11 @@ currently displayed lines pretty-printed.
6379
6480The following screenshot shows an XML blob with no indentation:
6581
66- ![ A flat blob of XML] ( /assets/images/lnav-before-pretty.png )
82+ ![ A flat blob of XML] ( /assets/images/lnav-before-pretty.svg )
6783
6884After pressing SHIFT+P, the XML is pretty-printed for easier viewing:
6985
70- ![ A pretty-printed blob of XML] ( /assets/images/lnav-after-pretty.png )
86+ ![ A pretty-printed blob of XML] ( /assets/images/lnav-after-pretty.svg )
7187
7288## Query Logs Using SQL
7389
@@ -81,7 +97,7 @@ SELECT c_ip, count(*), sum(sc_bytes) AS total FROM access_log
8197 GROUP BY c_ip ORDER BY total DESC ;
8298```
8399
84- ![ The results of a SQL query] ( /assets/images/lnav-query.png )
100+ ![ The results of a SQL query] ( /assets/images/lnav-query.svg )
85101
86102## "Live" Operation
87103
0 commit comments