3

Is there any tool that does both, colorize and filtering lines to suppress form output by regex?

4 Answers4

4

I tend to use a combination of tail, grep and ccze.

For example,

tail -f /var/log/messages | grep foo | ccze

Janne Pikkarainen
  • 31,852
  • 4
  • 58
  • 81
2

multitail does exactly what you're asking for and a whole lot more inside an ncurses interface.


multitail (at least on Ubuntu 10.04) ships with a well populated sample config file that will provide nice coloring on most system logs out of the box. A simpler quick-start version of a multitailrc would look like this:

defaultcscheme:foo

colorscheme:foo:all my foo messages
cs_re_s:red,white,bold/blink:([^:]*): says foo!
cs_re:green:.*: says foo!
cs_re:cyan:.*: says bar

# filter out the baz lines with this filterscheme
filterscheme:foo:gets rid of the baz
rule:ev:.*: says baz

usefilterscheme:foo:/var/log/foo

Both cs_re and cs_re_s have a similar format:

cs_re:FG_COLOR[,BG_COLOR[,ATTRIBUTE[/ANOTHER_ATTRIBUTE]]]:REGEX

cs_re_s will colorize only the substrings (things in parentheses).

This should get you started with multitail. If you want to get more fancy, take a look through the sample one provided with it and/or the docs.

mark
  • 2,365
  • 14
  • 11
  • multitail does a lot. That being said, I still have affinity for how tail -f *.log displays multiple files. And multitail UI is not the easiest to get used to, but that's related to the fact it does a lot. – lkraav Jul 27 '12 at 17:55
1

You can pipe tail to grep to suppress line output with regex.

tail input.txt | grep -v -e regex_pattern

Grep can alternatively colorize the parts that match the regex, makes finding a pattern in a log file easier.

Colorizing it by regex might be interesting though.

Chris S
  • 77,945
  • 11
  • 124
  • 216
0

Lots - is google down again? mtail, colortail, multitail...

symcbean
  • 21,009
  • 1
  • 31
  • 52
  • What search string to you type into google to get those answers? What are the advantages / disadvantages of each? This is a completely valid question for this site. – rjmunro Mar 31 '11 at 08:05