Re: View log files with emacs

[Tassilo Horn]

Hi Eike,

many logging formats have a one-line-per-message format, and if there
are multi-line messages, the second-to-last lines are indented, e.g.,

[2015-02-18 08:22][foobar] An error occured: java.lang.NullPointerException
  some.Class.method()
  some.other.Class.method()
  ...

In that case you can use Selective Display for folding, see:

,----[ (info "(emacs)Selective Display") ]
| Emacs has the ability to hide lines indented more than a given number of
| columns.  You can use this to get an overview of a part of a program.
`----

And you can use `occur' for filtering to messages of a given type (as
long as you can encode that in a regex):

,----[ C-h f occur RET ]
| occur is an interactive compiled Lisp function in `replace.el'.
| 
| It is bound to M-s o.
| 
| (occur REGEXP &optional NLINES)
| 
| Show all lines in the current buffer containing a match for REGEXP.
| If a match spreads across multiple lines, all those lines are shown.
| 
| Each line is displayed with NLINES lines before and after, or -NLINES
| before if NLINES is negative.
| NLINES defaults to `list-matching-lines-default-context-lines'.
| Interactively it is the prefix arg.
| 
| The lines are shown in a buffer named `*Occur*'.
| It serves as a menu to find any of the occurrences in this buffer.
| C-h m in that buffer will explain how.
| 
| If REGEXP contains upper case characters (excluding those preceded by `\')
| and `search-upper-case' is non-nil, the matching is case-sensitive.
| 
| When NLINES is a string or when the function is called
| interactively with prefix argument without a number (`C-u' alone
| as prefix) the matching strings are collected into the `*Occur*'
| buffer by using NLINES as a replacement regexp.  NLINES may
| contain \& and \N which convention follows `replace-match'.
| For example, providing "defun\s +\(\S +\)" for REGEXP and
| "\1" for NLINES collects all the function names in a lisp
| program.  When there is no parenthesized subexpressions in REGEXP
| the entire match is collected.  In any case the searched buffer
| is not modified.
`----

And if the log files are still in use (grow bigger), then
`auto-revert-tail-mode' is your friend as Filipp already pointed out.

Bye,
Tassilo