LogoRRR lets several search terms describe an investigation at the same time. Each successful term gets a color, a mode badge, a hit count, navigation controls, and an active/inactive toggle.
Create a search term
- Press Shortcut+F or focus the search field.
- Choose Literal or Regex.
- Enter the text or expression.
- Press Enter or activate the search button.
Literal is the default and ignores case. It is a good fit for severity names, class names, host names, request identifiers, and exact messages.
Regex uses RE2 syntax. It is case-sensitive unless the expression enables (?i). Regex terms and Literal terms with the same visible text remain independent searches.
| Need | Example |
|---|---|
| ERROR or WARN | `ERROR |
| Request identifiers | request-[0-9]+ |
| Case-insensitive timeout | (?i)timeout |
| HTTP 5xx status | HTTP/[0-9.]+" 5[0-9]{2} |
RE2 deliberately excludes backreferences and look-around assertions. Invalid expressions stay in the search field and do not replace the last valid result, selection, or viewport.
Understand Regex safety limits
Regex evaluation stays local and uses a linear-time engine. LogoRRR bounds individual expressions and unusually large per-line result sets so a problematic pattern cannot publish partial results indefinitely.
- Expressions can contain at most 4,096 characters.
- Compiled programs can contain at most 16,384 instructions.
- Regex evaluates at most 262,144 decoded characters per line.
- A line can publish at most 4,096 non-zero-width matches.
- Zero-width matches are ignored and matches do not overlap.
Literal search keeps its streaming path for arbitrarily long lines.
Read a search term
The term’s color appears in every coordinated view. The count reports matching lines. Previous and next controls move through visible character-level matches, select the exact range, and wrap when they reach the beginning or end.
Use the color control to choose a different visual identity. Drag the term’s regroup handle to change its horizontal position among the other terms. Removing a term releases its results without changing the source file.
Activate, deactivate, and filter
An active term contributes its matches to highlighting and filtering. Deactivating a term keeps it available but removes its contribution from the active filter.
Unclassified controls rows that match no active search term:
- When selected, unmatched rows stay visible beside matching rows.
- When unselected, only rows matching at least one active term remain visible.
- If no search term is active, hiding Unclassified leaves no classified rows to display.
Start with ERROR and WARN, then add a request, host, or thread identifier. Toggle individual terms to see which signal explains a cluster.
Save reusable groups
Use the add-to-favorites control to send the current custom terms to Settings → Favorites. A favorite can hold several patterns and can later become the default search vocabulary for another file.
Favorites and per-file groups can be reordered, recolored, or pruned. They store search definitions, not copies of matching log content.
Search while following or scanning a large file
Search works with live files and with progressively analyzed large files. Visible results can become useful before whole-file coverage finishes. When coverage is partial, LogoRRR reports that state instead of presenting a partial count as complete.