Hi Philer,

What I would recommend is creating a merge filter composed of three different filters: order start, order end and error detection.  This filter should show all orders as either two or three log lines.  If three log lines are shown, the middle log entry should be an error. 

Next, select the order begin and end log entries and Filter All Between them.  This will create a new filter on the root log file between the two provided timestamps.  This should contain all log entries in the order.

It would be great if we could do this in one step instead of two.  I will have a think.  Maybe we can improve on this with a new rule type.

Hope that helps,

Toby

My problem is that my log lines are grouped heavily. Imagine something like the log shows app actions on orders.
So each log "group" starts with a log line with the order number "order number:" . Then are following dozens of action log lines on that order. Than there is a separation line, and then the next order is processed...

What I usually want now is to filter whole orders not single log lines. This means I want to filter out orders where there group of log lines (of one order) contains a line with the text "error" AND a line with the text "customer has not paid" . And maybe a third condition (own line) "customer is female".
If I was to search single log lines, your text filter would work great.

But what I need is kind of treating a repeating group of log lines as they were one log line for the filteri ng so that I could use an "AND" condition for text filtering.

In other words- I would like to group text filters with "AND" concernig the whole log group.

Is there any possibility to get the log viewer the group of log lines because it doesn't sound to difficult ?

Maybe you have another method or idea. I kind of got something better than nothing to form a merged text filter with "OR" for every line. But as this does not replace the "AND" condition this is only of little help since I have to got through all filtered lines and have to look, if all filters are applied. (all text lines exist in that group) or only a part.