lnav

lnav copied to clipboard

Field discovery is really promising. My team uses the following format in the log body: Could not find user. Bail {userID: [email protected], region: someRegion, retryCount: 3}

This sounds like a natural pattern that would benefit from auto-discovery.

The discovery process doesn't drill down at the moment, so it is only picking up the top-level string (userID: [email protected], region: someRegion, retryCount: 3). You can use the extract() function in SQL to perform the discovery on a given string and get the results as a JSON object. For example, if you execute the following SQL while the given line is at the top of the log view:

SELECT extract(col_1) from logline

The result will be this JSON object:

{"userID":"[email protected]","region":"someRegion","retryCount":3}

You can then use SQLite's and lnav's JSON functions to extract the data you're interested in. For example, if you wanted the userID:

SELECT json_extract(extract(col_1), "$.userID") from logline

(Note that the discovery is goofy for this log line. For some reason it's picking up the '.' as a meaningful column, which is wrong. That may change in the future...)