Currently, Sift only supports line-separated JSON as input. Inputs that fail to parse as JSON are converted into a JSON object with the structure:
`json
{
"level": "info",
"message": "[INPUT]"
}
`

Logs ingested from STDERR are always assigned the level error, and may override the original value of level.

As each log is ingested, it is assigned a unique "Log Index", which is visible in the left column of the log display.

keyboard commands

- CTRL_C: Kill child process/Exit Sift
- UP/DOWN ARROWS: Move selection
- LEFT/RIGHT ARROWS: Scroll horizontally
- ENTER: Toggle between compact and expanded view of the selected log.
- ESCAPE: Clear query.
- PAGE_UP: Scroll up 20 entries.
- PAGE_DOWN: Scroll down 20 entries.
- HOME: Jump to first entry.
- END: Jump to last entry and resume auto scroll.
- SHIFT_LEFT/RIGHT ARROWS: Move query cursor left/right.
- CTRL_LEFT/RIGHT ARROWS: Select previous/next window, when split windows are used.
- SHIFT_PAGE_UP: Increase fuzzy matching threshold, broadening results.
- SHIFT_PAGE_DOWN: Decrease fuzzy matching threshold, narrowing results.
- TAB: Toggle Search/Filter views
- CTRL_N: Jump to next match in search mode
- CTRL_P: Jump to previous match in search mode

Changing the selection with UP/DOWN/PAGE_UP/PAGE_DOWN/HOME pauses log auto scrolling. Resume auto scrolling by pressing END to jump to the end of the logs.

Pressing TAB switches between filter view (default) and search view. In filter view, only logs that match the filter are displayed. In search view, all logs are displayed, and logs that match the filter are highlighted. Use CTRL_N and CTRL_P to jump to between matches.

See the in-app help page for a list of all key bindings.

$3

- \: insert \ into query
- f: Enter filter mode
- m: Enter message formatting mode
- c: close the current log panel
- g: goto log
- s: spawn process
- v: vertically split the current log panel
- ?: display help


See the in-app help page for information about all modes.

query language

To search all keys and values, just start typing your search.
`bash
> error
`
(matches objects with "error" as a key or value)

You can find logs matching a specific key-value pair by separating the key and value with a colon (:).
key:value

`bash
> level:error
`
(matches all objects with the key "level" whose value matches the string "error")

You can also type the colon but leave off the key or value to do a partial search.
key: or :value

`bash
> level:
`
(matches all objects with the key "level")

`bash
> :error
`
(matches all objects with the value "error" on any property)

To search specific keys within an object, use dot notation.
`bash
> node.data
`
(matches all objects with the "node" key whose value is an object with the property "data")

Dot notation works to any depth, and can be combined with a colon to match a specific value.

`bash
> node.data.id:42
`

All queries are matched using a case-insensitive fuzzy string matching algorithm. When you enter a query, each matching property and value across all logs is assigned a score based on how closely it matches the query. Logs are only displayed if the score for each part of the query exceeds the fuzzy matching threshold.

The default threshold has been selected to filter out irrelevant results, without excluding close matches, but in some cases can be too restrictive or permissive, especially for logs containing very long strings. You can make the search more strict with SHIFT_PAGE UP or more inclusive with SHIFT_PAGE DOWN.

The algorithm is provided by the farzher/fuzzysort library. It seems to be biased toward searching filename-like strings, and tends to give much higher scores to matches at the beginning of words, capital letters, after periods, etc. If a query isn't returning the results you want, try relaxing the search threshold.

Non-string datatypes are interpreted as strings during the filtering process.

$3

- (space): Logical AND. Example: error critical
- , (comma): Logical OR. Example: error,warn
- The AND operator (space) takes precedence over the OR operator (comma), meaning queries are always written in disjunctive normal form. Example: error critical,status failed means (error && critical) || (status && failed).
- ! (exclamation point): Exclude
- !key:value: matches objects with "value", excluding values associated with "key". Example: !timestamp:2020 returns logs with a value matching 2020 only if the property for that value does not match timestamp.
- key:!value: matches objects with "key" property, if the value of "key" doesn't match "value". Example: error:!connection returns logs with a property matching error only if the value associated with that property does not match connection.

You can also surround part of a query with quotation marks (") to search for a literal string, in case you want to search for a string containing sift operators. This is currently buggy and doesn't work if your query contains more than one quoted string.

filters

There are two types of filter rules: MATCH and FILTER.
- MATCH rules are joined with "OR". More MATCHES produce a larger result set.
- FILTER rules are joined with "AND". More FILTERS produce a smaller result set.

Access Filter Mode through the command panel by typing \f.

formatting

The default format is [{timestamp}][{level}]{message}, with coloring rules for logs with certain level values.
- info: white
- warn: yellow
- error: red
- sift: cyan (sift level logs are added by sift, e.g. indicating the process terminate).

Other logs levels are displayed in a dim gray.

The timestamp field is hidden on start-up, and can be enabled by entering Message FormattingMode by typing \m.

In the current version of Sift, you cannot create or edit formatting rules.

split windows

Spawn a process in a new window by typing \s and entering a command. Create a vertical split of an existing stream by typing \v. Press CTRL_C to terminate a running process or to close the window of a stopped process, or type \c to close a window without killing the process.

known issues

To test against auto-generated data.
`bash
yarn dev
`

test

To develop on Windows, you need to change the path in the package.json "build" script to point to the .cmd version of tsc. You also need to remove --enable-source-maps` from the scripts.