Hi Toby,

today I analyzed a more complicated case where I had to simultaneously look at log files from different sources. So I merged them to one log.
However since the number of log entries was so large that I had to pick out several messages in different combinations to narrow down the problem. For this I intensively used the merged filters (OR). However since I had to merge sometimes up to 6 different filters in different combinations (and since existing OR filters cannot be modified), things got a bit confusing temporarily. This brought up a wish I had for some time now.

It would be very nice to see also the single elements of the merged OR filter in the "Log Files & Filters" tree. What came to my mind is to make the OR filtered view expandable and collapsible. When expanding it, it lists the filters that are combined in the OR filter. This would also allow the modification of the filters, which is something that is also currently not possible. And even further (think that would be a new feature) one could also combine AND and OR filters to from expressions like "F1 OR F2 OR (F3 AND F4)" (The rule would be that the OR filter sums up the leaf nodes of each of it's subtrees.)

I tried to make a small illustration to show the idea.


What do you think?

Thanks
Andreas

Hi Toby,

that filter builder looks like a powerful solution. Would be nice to have something like this in the future.

I was also thinking again about your feedback. Sure, if you want to keep the simple rule of the filter tree that each tree element further filters down the log entries, then the proposed OR filter tree will violate that rule.

Then I would vote for a suggestion from your first reply. To display the "OR"-Subtree in the "Toolbox Tabs". This way one could easily see and modify the structure or details of the currently selected merged filter. Also my hope would be that this works in combination with the drag and drop of the filter tree. That is, that I can add already existing filters from the filter tree as new elements to the OR-filter or vice versa. And the possibility to delete parts of an existing OR-filter.

Remember, my original post was mainly to make the current OR-filter more easy to use. Currently I don't need more complex filters like it would be possible with the filter builder. If I have such cases I could also write my custom filter. However what I can't do with custom filters is the easy usage with drag and drop.

Don't get me wrong, sure a more powerful filter builder would be great to have in the future. But currently my focus is more on usability of the current filter possibilities.

Thanks,
Andreas