User Guide

Quick Start

1. Launch the application — the Import Data dialog opens automatically.
   You can always get to import data dialog by clicking the Import button in the Log Manager toolbar (or pressing Ctrl+I).
2. Pick a source type — File, SFTP, Kubernetes, Database, or URL — and load it.
   Source type tabs for types other than file or url are disabled in the Import data dialog by default. These datasources can be added through the Settings dialog.
3. The viewer attempts to auto-detect the log format (pattern) and opens in a new tab.
   If no existing pattern matches, a catchall format is used.
4. Type a query in the filter bar (e.g. level = 'ERROR') and press Enter.
5. Drag the time-slider thumbs (left edge of the table) to narrow to a time window.

Importing Logs

Click Import in the Log Manager toolbar (or press Ctrl+I) to open the Import Data dialog. It has one tab per source type — File, SFTP, Kubernetes, Database, and URL.

Local Files

1. Select the File tab.
2. Click Browse… or drag and drop one or more files onto the drop area.
3. Choose a File Type (Generic, or a specific type) and a Pattern — leave as Auto Detect to let the app pick the best match.
4. Check Merge files to combine multiple selected files into one chronological view immediately on import (equivalent to importing them separately and then using Merge in the Log Manager).
5. Click Import.

External Databases

Supported drivers: MySQL, PostgreSQL, ClickHouse, Oracle, SQLite, and any custom JDBC driver registered in the Driver Editor.

1. Select the Database tab.
2. Pick a saved datasource, or create one via the DB Datasource Editor (host, port, database, credentials).
3. Choose the target table and a Log Pattern describing its columns.
4. Click Import.

Kubernetes Logs

1. Select the Kubernetes tab.
2. Pick a saved cluster connection (configured via the Kubernetes Datasource Editor — paste a kubeconfig or point at a config file).
3. Choose a namespace and pod (or a pod-name filter for multi-pod streaming), then import.

SFTP Remote Files

1. Select the SFTP tab.
2. Pick a saved connection, or create one via the SFTP Datasource Editor (host, port, username, password, or an SSH private key — optionally the app-wide default key set in Settings).
3. Browse the remote filesystem and select a file to import.

The file downloads to a local temp cache and opens in the standard viewer; large files stream page by page.

HTTP / URL Sources

1. Select the URL tab.
2. Paste an HTTP or HTTPS URL that returns plain-text log data.
3. Select a log pattern and import.

Request Options — Headers & Pagination

Click Request Options… on the URL tab to add custom request headers, a POST body, and multi-page fetching for APIs that don't return everything in one response.

Payload / Body

Only sent with POST requests (set the method on the URL tab first). A body starting with { or [ automatically gets a Content-Type: application/json header. Reference the current pagination value with ${paramName}, matching whatever you type into Param Name below:

{"query": "level:ERROR", "page": ${page}, "pageSize": 100}

Headers

Click Add to insert a row — the Name cell is focused immediately so you can type right away. Press Enter, Tab, or type : to jump from Name to Value. Headers are sent with every request, including every page of a paginated fetch:

Authorization: Bearer eyJhbGciOi...
Accept: application/x-ndjson
X-Api-Key: 3f29a1c0-...

Pagination

Check Enable Pagination and pick a Type. Param Name is the query parameter (GET) or ${placeholder} key (POST payload) that carries the page value; Page Size and Max Pages cap how far the import will keep fetching — it also stops early the moment a page comes back empty.

Example — PAGE, GET request. URL https://api.example.com/logs, Method GET, Param Name page, Page Size 100, Max Pages 5:

GET https://api.example.com/logs?page=1
GET https://api.example.com/logs?page=2
GET https://api.example.com/logs?page=3
...

Example — OFFSET, POST request. Method POST, Param Name offset, Page Size 500, Payload:

{"query": "level:ERROR", "offset": ${offset}, "limit": 500}

sends bodies with offset equal to 0, then 500, then 1000, and so on for up to Max Pages requests.

Example — CURSOR, GET request. Param Name cursor, Cursor JSON Path meta.next_cursor. If page 1's response body is:

{"items": [...], "meta": {"next_cursor": "abc123"}}

page 2 is fetched as ...?cursor=abc123; fetching stops as soon as a response has no meta.next_cursor value.

Log Manager Dashboard

The Log Manager is the central hub. It lists every open log view with its name, error/warning summary, and date range.

Toolbar actions:

• Query filter — filters the list of windows itself (not their contents) by name.
• Filter Selected — opens a merged, filtered view scoped to the selected windows.
• Selected: + / 🔀 / ✕ — with one or more rows checked: Merge the selected windows, Group the selected windows, or Close the selected windows.
• Watches (bottom bar) — expand to manage cross-log watch/alert rules that scan open logs for matching entries.

Docking and Undocking

Every new view opens as a tab inside the main Log Docker by default.

• Undock: Click Undock in the viewer header to pop the tab out into a resizable standalone window.
• Redock: Click Dock in the floating window's toolbar to return it to the tab bar.
• Undocked windows keep all filters, bookmarks, and time-slider position when redocked.

Window Layouts

Merging Logs

Merging lets you view entries from several sources in a single chronological stream — ideal for correlating events across microservices.

1. In the Log Manager, check two or more windows.
2. Click the merge icon under Selected:. A new Merged View tab opens.
3. Each source gets a distinct color. The Source column shows every row's origin.

Grouping Windows

Groups tag a set of open windows with a shared name and color, so they can be saved and reloaded together later, or analyzed as a set.

1. Select two or more windows in the Log Manager and click the group icon under Selected: (or Ctrl+G).
2. In Group Windows, enter a name (or pick an existing group to reuse its color), choose a color, and leave Save group for later reloading checked to persist the group to disk immediately.
3. Click Set Group, or Clear Group to remove the tag from the selected windows.

Once at least one group exists, the Log Manager shows Save Group and Analyze Group buttons:

• Save Group — pick a group and persist its currently open windows to disk for later reloading (the same action the checkbox above performs automatically).
• Analyze Group — pick a group and generate an aggregated analysis report across every log file in it.

The resulting Group Analysis report aggregates severity counts and an hourly issue-frequency chart across every file in the group, plus a per-file breakdown table (rows, errors, warnings). Additional tabs cover Issues & Clusters and Token Linkage for deeper cross-file correlation.

The Log Viewer

Table Overview

• Column resize: Drag any column edge.
• Row order: Rows stay in log order (chronological in merged views); clicking a header doesn't re-sort them.
• Column widths are saved with the session.

Row Detail View

Double-click a row (or press Enter) to open the Row Detail panel. It shows every field fully wrapped, with one-click copy for individual fields or the entire entry.

Filtering Logs

The filter bar at the top of every viewer accepts SQL-style WHERE expressions. Press Enter to apply; click the X next to it, press Ctrl+Shift+L, or press Escape in the field to clear (Escape first undoes an edit you haven't applied). Previously used filters appear in the dropdown, and the row count updates immediately to show how many entries match.

Filter Query Syntax

Column names match the pattern's field names: timestamp, level, message, thread, and source (merged views).

Equality and inequality

level = 'ERROR'
thread = 'http-nio-8080-exec-1'
level != 'DEBUG'

Set membership (IN / NOT IN)

level in ('ERROR','WARN')
level not in ('ERROR','WARN')

Pattern matching (LIKE / NOT LIKE)

% matches any sequence; _ matches exactly one character.

message LIKE '%NullPointerException%'
logger  LIKE 'com.example.%'
message NOT LIKE '%health%'

Comparison and range (timestamps and numbers)

timestamp >= '2026-06-01T08:00:00Z'
timestamp <  '2026-06-01T09:00:00Z'
timestamp BETWEEN '2026-06-01T08:00:00Z' AND '2026-06-01T09:00:00Z'

Boolean logic — AND / OR / parentheses

AND binds tighter than OR. Use parentheses to group sub-expressions.

level = 'ERROR' AND thread = 'main'

(message LIKE '%timeout%' OR message LIKE '%connection refused%') AND level = 'ERROR'

-- Slow DB calls in one package:
logger LIKE 'com.example.db.%' AND message LIKE '%ms%' AND level != 'DEBUG'

Filter-Out (Exclusion)

Use Filter Out to hide noise without changing the main filter.

1. Click Filter Out in the toolbar.
2. Enter exclusion rules using the same syntax as the main filter.
3. Apply. Matching rows are hidden.

-- Exclude health-check and metric noise:
message LIKE '%actuator/health%' OR logger LIKE 'io.micrometer.%'

Search and Find

Find (Aa field, or Ctrl+F) highlights all occurrences of a text string within the visible rows.

Turn the find text into a filter: click the magnifier button beside the find field (tooltip Add filter for find text) to build a query that matches the current find text across every column — col1 LIKE '%text%' OR col2 LIKE '%text%' … — apply it to the filter bar, and clear the find field. Where Find only highlights matches in the loaded rows, this narrows the table to matching rows and runs over the full dataset, including SQLite-paged files.

Time Slider

The vertical slider on the left edge of the table represents the full time range of the loaded (and filtered) log. It only appears for patterns that include a timestamp column.

• Drag a thumb to narrow or expand the time window. The table filters on mouse release.
• Click the track (not a thumb) to scroll the table to that position without filtering.
• Right-click a row → Set Time Range → Start or End to move that end of the range to the row's timestamp, without dragging. The other end stays where it is, unless it would end up on the wrong side; then it opens up to the start or end of the log.
• Hover over any marker or thumb for a tooltip showing the exact timestamp.

Synch All (Line Up Open Logs by Time)

When you'd rather keep logs in separate windows than merge them, Synch All in a viewer's toolbar scrolls every other open log to the moment you're looking at.

• If a row is selected and on screen, its timestamp is the reference time. Otherwise the row in the middle of the current view is used.
• Each other log centers on the row closest to that time, or scrolls to its start or end if the time falls outside it.
• Logs without a timestamp column, or still loading, are skipped.

Bookmarks and Highlights

Bookmarks let you pin important rows for navigation, review, and later filtering.

Creating a bookmark: right-click a row → Bookmark (uses the last-used color), or Bookmark [choose color] to pick a color from the palette (10 colors). A colored marker appears on the row background and on the time slider.

Right-clicking an already-bookmarked row shows options to manage it:

• Remove bookmark — clears the bookmark from the row.
• Change color — reassign the bookmark's color.
• Bookmark comment… — attach a free-text note to the bookmarks of this color, useful context when reviewing or feeding an analysis to an AI prompt.

Bookmark Time (Time Correlation)

Bookmark time… (on the row context menu) bookmarks every row whose timestamp falls within a configurable leeway of the selected row, in every open log (including this one) or in a chosen group. It's the fastest way to line up related events across several logs that don't share a common request ID.

1. Right-click the row of interest → Bookmark time…. If several rows are selected, the window runs from the earliest to the latest of them.
2. Choose a Leeway window (±5 ms up to ±1 min, default ±50 ms, or a custom value).
3. Pick a Bookmark color.
4. If any open windows have been grouped, a Target dropdown lets you limit the bookmarks to one group instead of All Logs.
5. Click Bookmark.

The chosen color gets an automatic comment recording the source row and leeway, so you can tell later where those bookmarks came from.

Bookmark Filters

Toggle the bookmark button in the viewer header to switch on Show bookmarks only, which hides every non-bookmarked row. From there, use Bookmark Filters (the settings icon next to the bookmark toggle) to narrow that down further to specific bookmark colors — useful once you have several bookmark colors in play for different purposes (e.g. using distinct colors for grouping rows of interest)

Toggle individual colors (or Annotations / Notes, the special bookmark categories) on or off, then OK to apply.

Annotation Bookmarks

Annotations are saved queries that are automatically applied as bookmarks whenever a matching log file is loaded — and optionally raise a watch/alert.

1. Right-click a row → Annotate (or manage them via Settings → Annotations → Annotation Manager…).
2. Give the annotation a description, and confirm or edit the Query Pattern (pre-filled from the row you right-clicked, e.g. Message LIKE '%Potential hang on request id=%').
3. Optionally restrict it to files whose name contains a given string via Filename Filter.
4. Optionally set Watch Severity (None, INFO, WARN, ERROR) to also raise a watch alert during tailing and on file open — leave it at None (annotation only) for a silent bookmark.
5. Save.

On every load, the application runs each matching annotation in the background and marks the matching rows. Annotation bookmarks are listed as their own category in the Bookmark Filters dialog, separate from the numbered color bookmarks.

Live Tailing

1. Click Tail (▶) in the viewer toolbar.
2. New entries appear at the bottom as they arrive. The table auto-scrolls to the latest entry.
3. Click anywhere in the table to pause auto-scroll; it resumes when you scroll back to the bottom.
4. Click Tail again (■) to stop.

• File rotation: Detects when app.log is replaced by a new file and restarts reading automatically.
• Kubernetes tailing: Streams new pod log lines with minimal delay.
• Filters during tail: All active filters apply in real time — keep an ERROR filter to see only exceptions as they occur.

Log Analysis

Click the bar-chart icon (Analyze Currently Displayed Log Rows) in the viewer toolbar to generate a report over whatever is currently shown — the full file, or the result of your active filter and time range.

• Summary — total entries, error/warning counts and percentages, an error/warning frequency-over-time chart, and a severity breakdown pie chart.
• Errors / Warnings — the individual matching rows.
• Frequency — a time-bucketed breakdown of activity.

At the bottom:

• Redact sensitive data (checked by default) — scrubs values before they're shown or exported, applying your custom Redaction find/replace rules first, then pattern-based redaction (IPs, emails, etc.).
• Unredact text — reveals the original text again (only enabled once redaction has been applied).
• Copy as markdown / Save as file — export the report, e.g. to paste into a ticket or an AI assistant.

Reloading and Load Settings

Click Reload to re-read the source with its current pattern and settings, or click the gear icon (Log Settings) to change how it's loaded before reloading:

• File Type / Log Pattern — switch which pattern is used to parse the file.
• Source Timezone — the timezone the raw timestamps are written in (if not embedded in the format itself).
• Display Timezone — the timezone timestamps are rendered in in the table (independent of the source timezone).
• Append non-matching lines to previous row's last field — when a physical line doesn't match the pattern (e.g. a stack-trace continuation line), append it to the previous row instead of dropping it or creating a malformed row.
• Filter Annotations — jump straight to managing annotations that apply to this file.

Click Reload to apply the changes.

Comparing

Two tools answer "what's different?" without leaving the application: the Compare window for anything you paste or send to it (text, lists, timestamps), and Compare Rows for two rows of a log.

The Compare Window

Open it any of these ways:

• Click the Compare button (two arrows) in the main toolbar, next to Notepad.
• Press Ctrl+Shift+D in any window — the docker, an undocked log viewer, or a dialog.
• Right-click rows in a log viewer → Send to Compare → Left or Right (see below).

There is one Compare window for the whole application. It isn't tied to the log view that opened it, so you can keep it beside your logs as a scratch tool and paste or send text into it from any window; opening it again just brings it to the front.

Paste into Left and Right — the result updates as you type. Swap exchanges the two sides and Clear empties both. Choose what kind of comparison you want with the Text / Lists / Time buttons:

Text

• A side-by-side, line-by-line diff with line numbers. Removed and changed lines are shown in red on the left, added and changed lines in green on the right, and the characters that changed are highlighted — v2.3.1 → v2.4.0 highlights just 3.1 / 4.0.
• Lines that are edits of each other are lined up even when lines were added or removed around them, and a mostly rewritten line is highlighted as a whole.
• The heading summarises the result, e.g. 3 changed · 1 added · 1 removed lines, or Identical.
• Ignore case and Ignore whitespace compare loosely; Collapse unchanged lines (on by default) shrinks long unchanged stretches to … 42 unchanged lines …, keeping two lines of context around each change.
• Above 50,000 lines on either side the diff waits for you to click Compare.

Lists

Answers "are these the same list, ignoring order?". Each side is split into items and compared as a whole, counting duplicates — a, a, b and a, b, b hold the same values but are different lists.

Split on chooses what separates the items: Lines (one item per line), Whitespace (any run of spaces, tabs or line breaks), one of the same delimiters offered for CSV patterns — Comma, Semicolon, Colon, Pipe, Tab — or type your own (any length, taken literally). With a delimiter, line breaks still separate items too, so a delimited list spread over several lines compares correctly.

Picked for you: the delimiter is chosen automatically — whichever CSV delimiter appears most in the two sides, if it clearly beats the others (otherwise Lines). Colons inside times of day such as 10:54 don't count, and Whitespace is never picked automatically. auto next to Split on shows it was picked for you; choose one yourself and it stays until you press Clear.

• The verdict is Identical, Same items, different order, or Different, with the item counts for each side.
• Only in Left / Only in Right list the items missing from the other side. When an item is on both sides but repeated a different number of times, a third column, In both, different count, lists it (e.g. ORD-1004 (2 vs 1)); it's hidden when there are none.
• Options: Trim spaces around each item, Ignore case, and Ignore blank lines (also skips empty items, e.g. from a trailing delimiter).
• Select entries and press Ctrl+C (or right-click → Copy) to copy them; Copy all copies the whole column, even past the first 10,000 entries shown.

Time

Paste one timestamp on each side to get the time between them (Right − Left), e.g. +2m 14.381s and the exact 134,381 ms. Paste several, one per line, and the table pairs them up line by line and also shows the gap between consecutive timestamps on each side — handy for latency questions.

To look at the gaps in a single list of times, paste it into Left only (or Right only): the table shows each timestamp and the gap before it, and the heading gives the count, the total span, the average gap and the largest gap with where it occurs.

Accepted formats include:

• The viewer's own display format — 2026-09-03 - 10:54:14.074, also with / or . in the date (2026/09/03 - 10:54:14.074).
• ISO-8601 with or without an offset — 2026-09-03T10:54:14.074Z, 2026-09-03T12:54:14+02:00.
• Space-separated, including log4j's comma milliseconds — 2026-09-03 10:54:14,074.
• Epoch seconds, milliseconds, microseconds or nanoseconds — 1788432854, 1788432854074.
• A time of day on its own — 10:54:14.074 (taken as today).

Send to Compare

Right-click in a log viewer → Send to Compare → Left or Right puts the text into that side of the Compare window (opening it if needed) and leaves the other side as it is. It sends exactly what Copy would copy: text you've selected inside a cell, otherwise the selected cells or rows, otherwise the row you right-clicked. Several selected rows arrive one per line, ready for Lists mode.

Send Left from one viewer and Right from another to compare across windows — for example a merged view against one of its source logs.

Compare Rows

Select exactly two rows in a log viewer, right-click → Compare Rows. To select the two rows, click the first, then Ctrl+click the second (it can be anywhere in the view). If they're next to each other, you can also Shift+click or drag over the two. Any cells will do, as long as they're in exactly two rows; the menu item only appears then.

• The headline is the time between the rows, with the exact milliseconds and the timezone the times are shown in (the viewer's display timezone).
• Every column, the timestamp included, is shown side by side — First row is the upper row in the viewer — with the changed characters highlighted. In a merged view the source file is included.
• Show only differing columns (on by default) hides the columns that match; the count beside it says how many differ.
• Long values (a stack trace, a JSON payload) wrap, and scroll within their own cell once they're taller than about 12 lines.
• Swap reverses the two rows.
• There is only one Compare Rows window. Comparing two more rows replaces what it shows and brings it to the front. If you compare from a different log viewer, the window moves to that viewer. It closes when its log viewer closes.

Selecting and Copying

All the compared text can be selected: drag to select, double-click for a word, triple-click for the whole value, then Ctrl+C. Right-click offers Copy, Select All and Copy All. In the Lists and Time tables, select rows and press Ctrl+C.

Log Patterns

A Log Pattern tells the application how to split each log line into structured columns. The correct pattern is essential for filtering, the time slider, and merging.

Auto-Detection

When you open a file, the application scans the first several hundred lines and tries every known pattern in order of specificity. If a pattern matches, it is selected automatically.

If auto-detection fails, the file is opened with the Catchall pattern, which loads every line as a single unstructured message column with no timestamp.

Built-in Pattern Types

Pattern Editor

Open the Log Pattern Editor from Settings → Patterns → Log Pattern Editor…, or, in a log that loaded as a single Message column, right-click a row and choose Create Pattern from This Row... to start from that line.

1. Load Existing Pattern to edit one, or start fresh by filling in Pattern Name, Pattern Type, and a Sample Log Line.
2. Write (or generate — see Regex Pattern Generator) a Regex Pattern with capture groups.
3. Set the Time Parse Format (Java DateTimeFormatter syntax), or click ISO for a standard ISO-8601 shortcut.
4. Click Apply Regex to Sample to populate Column Mappings from the sample line, then adjust each column's Column Name, Column Type, and Column Size (see Column types and sizes).
5. Save Pattern. Patterns can also be Imported / Exported as files to share between installs.

Example pattern for a typical Logback line:

^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3})\s+(\w+)\s+\[([^\]]+)\]\s+([\w.$]+)\s+-\s+(.*)$

Column types and sizes

Each row in Column Mappings sets how one captured value is stored and shown. Column Type controls what Klunk does with it:

Column Size sets how wide the column starts in the viewer. New columns start at MEDIUM; you can always drag column edges afterwards.

Regex Pattern Generator

Don't want to hand-write a regex? Click Generate Regex next to the sample line in the Pattern Editor.

1. Working left to right along the Sample Log Line, select the portion you want as a capture group and click Add Selected as Group. Repeat for each field (timestamp, level, thread, message, …).
2. Unselected text between groups is kept as Literal text the regex must match exactly.
3. The Generated Regex Preview builds up live as you add groups.
4. Click Apply to copy the generated regex back into the Pattern Editor's Regex Pattern field, then map each group to a column as usual.

Changing a Pattern After Load

You can switch patterns on an already-loaded file without closing and re-opening it: click the gear icon in the viewer toolbar to open Load Settings, change Log Template, and click Reload.

Managing Datasources

Beyond the one-off Import dialog, connection details for databases, Kubernetes clusters, and SFTP servers can be saved as reusable datasources so you don't have to re-enter credentials each time. Manage them from Settings → Datasource: Database / Kubernetes / SFTP, or directly from the Import Data dialog's respective tab.

DB Datasource Editor — create, edit, test, and delete saved database connections (name, DB type, driver, host, port, database, username, password, or a raw JDBC URL). Passwords are stored encrypted unless Save password is unchecked.

Click Manage Drivers to register a custom JDBC driver (name and main class) beyond the built-in ones:

Kubernetes Datasource Editor — save a named cluster connection, either by pasting a kubeconfig directly or pointing at a config file on disk, then Test Connection before saving.

SFTP Datasource Editor — save host, port, username, and either a password or an SSH private-key path (with optional passphrase). If a default SSH key is configured in Settings → Datasource: SFTP, individual connections can rely on it instead of specifying their own key.

Session Persistence

Klunk - Log Viewer can save your workspace when you close it and restore it on next launch — toggle Save Session on Close in the Log Manager toolbar.

What is saved per viewer:

• Source file paths or database/Kubernetes/SFTP connection details
• Active log pattern
• Applied text filter and filter-out rules
• Selected time range
• Bookmarked rows and their colors
• Column widths
• Window position and size (for undocked windows)
• Whether tailing was active

Performance and Virtualization

Klunk - Log Viewer handles very large log files through adaptive storage: smaller logs are held fully in memory, and larger ones switch to SQLite-backed paging. The switch-over point is log.virtualization.threshold (default 50,000 rows).

In SQLite-paged mode, filtering uses SQL WHERE clauses executed in SQLite — no memory overhead.

Tuning virtualization — raw properties editable under Settings → Advanced:

Raise the threshold if you have ample RAM and prefer the faster in-memory experience. Lower it if you see high memory usage with large files.

Application Settings

Open Settings from the Log Manager toolbar. It's a collapsible accordion — click a section header to expand it.

Appearance

Patterns

Opens the Log Pattern Editor.

Datasource: SFTP / Kubernetes / Database

Each opens the corresponding datasource editor. The SFTP section also lets you Browse… to or Generate New… a default SSH private key used automatically by SFTP connections that don't specify their own.

Annotations

General Settings

Redaction

Literal find/replace substitutions (case-insensitive) applied before pattern-based redaction when generating Log Analysis or Group Analysis reports — e.g. replacing a real company or hostname with a generic placeholder before pasting a report into an AI assistant.

Advanced

Directly edit raw configuration properties not exposed elsewhere in the UI — useful for the virtualization tuning properties and any watch.alert.* export settings. Some changes may require a restart.

Keyboard Shortcuts

Any Window

Log Manager

Log Viewer

Troubleshooting

"No content available" after opening a file

The log pattern did not match any lines. Try:

1. Click the gear icon (Log Settings) → change Log Pattern to a different pattern.
2. If no built-in pattern fits, open the Pattern Editor and create a custom one.
3. As a last resort, use the Catchall pattern — it loads every line as a raw message.

Time slider is not visible

The time slider only appears for patterns that include a timestamp column. Add a timestamp field in the Pattern Editor to enable it.

Filter returns no results for a valid timestamp

Both 2026-06-03T04:15:48Z and 2026-06-03T04:15:48.000Z are equivalent and both accepted. Display-format queries like 2026-06-03 - 04:15:48.000 also work.

Application is slow when scrolling a large file

• Check whether the file exceeded the virtualization threshold — SQLite-paged files fetch pages on demand rather than holding everything in RAM.
• If you're on a large file still in in-memory mode, lower log.virtualization.threshold in Settings → Advanced so paging activates earlier.

"Parsing and inserting log entries" progress never clears

A background query (e.g. an annotation lookup) may be holding a read lock when the reload starts. The lock releases automatically. If it happens frequently, try disabling Apply bookmark annotations on load in Settings → Annotations while working with very large files.

Session does not restore a window

If a source file has moved or is unavailable at startup, that viewer is skipped during session restore. Re-open the file from its new location and the saved filters and bookmarks are picked up on the next close.