← Documentation

Streams

A Stream is what produces lines into the right-pane tail view. Every stream belongs to one Source (Local / SSH / GCP / Firebase). One Source can have many Streams.

Creating a stream

+ ▸ New Stream…

Fields depend on the parent source's kind:

Rotated logs (daemontools-style logdirs)

Many service loggers - multilog (daemontools), svlogd (runit), s6-log (s6), and cyclog (nosh), as used by systems like Victron Venus OS - write their live log to a file named current and, when it fills, rename it to a dated @… archive in the same folder, keeping a small set of recent files.

When a stream points at a file named current, LogRaker recognizes this layout and, for the initial history only, reads back across those @… archives - so you still get the number of history lines set in Settings ▸ General, even right after a rotation when current itself holds only a few lines. This is automatic, based on the file name; other log files are read normally. Over SSH, archives that a logger's processor has gzip-compressed are decompressed automatically. (In the App Store edition's sandbox only the file you picked is readable, so there the history comes from current alone.)

Filters

LogRaker filters are a list of wildcard patterns. A line is shown if it matches any pattern.

Examples:

Pattern Matches
panic lines containing panic
error code ??? error code 500, error code abc, …
WARN* lines containing WARN followed by anything
panic, OutOfMemory* either panic OR anything starting OutOfMemory

Filters are substring-style: the pattern is matched anywhere in the line, not anchored to the start.

In the stream editor each pattern appears as a pill: press Return (or type a comma) to commit the pattern you're typing, click a pill and press Delete to remove it, and double-click a pill to edit it in place - Return commits the change, Esc restores the original.

Selecting lines

Selection in the log is line-oriented, like a list. Shift-click extends the selection through whole lines, in either direction; Cmd-click adds or removes a single line, so a selection can skip around. The highlight draws as one band per selected block, and copying gives you whole lines.

Home and End jump the selection to the very first / last line, in merged views and Monitor panes too; End rejoins the live tail. Right-clicking a line outside the selection selects that line first, so the menu acts on what you see ringed; right-clicking inside the selection leaves it alone.

Dimming the noise (triage)

When you are hunting a needle in a haystack, most of the log is chatter. Two commands clear it, and they differ in what they look at.

'Dim Similar Lines' acts on what you picked. Right-click a noisy line and LogRaker turns it into a template on the spot: the timestamp is stripped and the varying numbers (durations, counters, sizes) become * wildcards, so one click catches every near-identical line. Select a block of mixed chatter first and every different kind of line in it gets its own pattern in one go; a selection within a single line is used verbatim as the fragment to match. From the keyboard it reads the live selection, or the caret's line when nothing is selected. 'Focus on Similar Lines' is the inverse of the same pick: everything not matching dims.

'Dim Repetitive Lines' ignores the selection and sweeps the whole buffer. LogRaker goes through the entire scrollback, groups the lines that are alike apart from their numbers, and dims every line that repeats - ten lines or more qualifies - busiest first, up to eight patterns per pass; run it again after removing pills to reach the ones further down. The needle is by definition rare, so one click leaves only the unusual lines bright. What you have selected makes no difference to it.

Patterns are case-insensitive, * matches anything, everything else is literal - except that a JSON object in the pattern ({"key":value, …}) matches its fields in any order, since structured logs often shuffle them between entries. Hold Option in the menu to edit the pattern by hand before applying.

While anything is dimmed, a bar of pattern pills floats at the top of the tail: one pill per pattern with its live match count - click a pattern pill to remove it. The patterns one action added together (a block selection, a 'Dim Repetitive Lines' pass) sit in a labeled box of their own ('Similar Group 1', 'Repetitive Group 2'), and clicking the label removes the whole group at once - plus a 'Hide Dimmed' switch that collapses the dimmed lines entirely (your last choice is remembered - it re-applies by itself the next time you dim), and 'Clear All'. Every step is undoable with Cmd+Z.

The whole flow also runs from the keyboard: ⌘D dims every line like the ones you selected, ⌥⌘D focuses instead, and ⌘⇧D runs the repetitive sweep (all under View ▸ 'Dim'). After a keyboard dim the selection hops to the nearest still-bright line - climbing up through history first, the way triage is walked from the live tail - so clearing a haystack is just ⌘D, glance, ⌘D, until only the unusual remains.

Dimming is triage, not configuration: it is per-stream, and it composes with the stream's Filter (which permanently strips lines before they ever land).

Wildcards vs. literal text

By default a Filter field reads your text as wildcards. Click the magnifying-glass icon inside any filter field - the toolbar's, or a pane's own filter inside a layout - to choose how the pattern is interpreted:

This is one app-wide setting: changing it in any filter field - toolbar or layout pane - applies to them all, and it's remembered between launches. (The per-stream filter saved in the stream editor always uses wildcards.)

SSH journal streams (systemd / journald)

On an SSH source, a stream can follow the host's systemd journal instead of a file - set Source to Journal in the stream editor. There's no File field; you pick the units to follow, an optional severity floor, and an optional current-boot limit, with a live Preview of the journalctl command. See Journal streams for details, including the host permissions needed to read the system journal.

GCP & Firebase streams

GCP and Firebase streams don't have a File field - there's no file. Instead the editor builds a Cloud Logging filter for you from structured controls (Resource, its per-resource fields, and Severity), with a live Preview of the compiled query and a Test Cloud Logging Filter button.

The available resource list depends on the source kind:

Pause / Resume

Pausing a stream is display-only. The tail keeps running in the background, the sidebar status LED keeps pulsing, the line counter keeps incrementing - but the right pane stops scrolling and stops appending new lines until you resume. When you resume, you catch up to the most recent output.

Pause is per-stream, per-window. Hide-while-paused doesn't affect Monitor matching or any other consumer of the stream.

Scrollback

The displayed scrollback is capped at ~4 million characters to keep rendering fast on very chatty streams. Older lines are dropped from the displayed buffer (but the source file is unaffected - re-open the stream to start fresh).