https://github.com/dorthu/lf
logfmt filterer and formatter inspired by jq
https://github.com/dorthu/lf
logfmt logfmt-parser logging
Last synced: 8 months ago
JSON representation
logfmt filterer and formatter inspired by jq
- Host: GitHub
- URL: https://github.com/dorthu/lf
- Owner: Dorthu
- License: bsd-3-clause
- Created: 2024-04-26T04:14:28.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2024-05-24T02:14:46.000Z (about 2 years ago)
- Last Synced: 2025-08-14T09:07:07.803Z (10 months ago)
- Topics: logfmt, logfmt-parser, logging
- Language: Go
- Homepage:
- Size: 22.5 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# lf
logfmt parser and filterer inspired by [`jq`](https://jqlang.github.io/jq/)
## Usage
Suppose your application outputs logs like this:
```
time="2024-04-26 20:56:00" msg="example message" tag=example
```
To get an easier-to-read format, you might pipe the log to `lf` like so:
```
tail -f /var/log/file | lf [.time] .msg
```
If you only wanted records with the tag "example2", you might do this:
```
tail -f /var/log/file | lf tag=example2
```
And to give output only matching lines in an easier format, you might say:
```
tail -f /var/log/file | lf 'tag=example | [.time] .msg'
```
`lf` provides two features: **Filtering** and **Formatting**
### Filtering
Filters are given as key/value pairs like normal logfmt, except that the `=` may be
one of four allowed operators:
| Operator | Meaning |
| --- | --- |
| `=` | Value must match exactly |
| `!=` | Value must not match exactly |
| `~` | Value must be present in record |
| `!~` | Value must not be present in record |
| `+` | The key must be present. Takes no argument |
| `-` | The key must be absent. Takes no argument |
For example, for this input record:
```
id=12345 msg="it worked"
```
The following filters match:
```
id=12345
id!=4567
id+
msg~worked
msg!~failed
absent-
```
The key must always be present to a match to occur unless matching on key
absence; none of the following filters match the above record:
```
tag=test
tag!=test
tag~test
tag!~test
```
### Formatting
Format strings are templates that replace the placeholder values, which must start with
a `.`, be valid logfmt keys, and must follow a character that could not be part of a valid
logfmt key, with the values of the like-named key.
For instance, for the following record:
```
id=12345 msg="it worked"
```
The following format strings would produce the given output:
| format | output |
| --- | --- |
| `.id` | 12345 |
| `[.id] .msg` | [12345] it worked |
| `.id.msg` | 12345.msg |
| `.tag (.id): .msg | (12345): it worked |
### Which Is Provided?
When `lf` receives args that include a `|`, that character is expected to divide
filters from formats; the output format is to the right of the last `|`, and all else
is a filter (additional `|` characters are redundant).
If `lf` receives no `|` in its args, it uses hueristics to decide if it was given a
filter or a format. When in doubt, the args are assumed to be a format.
To disambiguate, include a `|` character - filters/formats are not otherwise required.