Expression filters.

An expression filter evaluates a C# condition for each row in the active view and keeps rows where the result is true. Use it for parsed numbers, time windows, optional fields, nearby lines, and string or regex helpers.

RETURNS bool

SCOPE active view

OPEN Ctrl+Shift+F

CLI --filter-expr · --filter-expr-file

expression filter · main shape condition

# keep only rows that match this condition
Level == "Error"
  || Col("sc-status").AsInt32() >= 500

# the same filter can use parsed time and service fields
Timestamp >= NowUtc().AddMinutes(-15)
  && Service == "api"

Use direct identifiers for C#-safe column names. Reach for Col("name") when the schema contains spaces, dashes, or names that collide with built-ins.

Return typebool only

Column accessIdentifier · Col("name") · Col(1) · Has("name")

ContextRawLine · RowNumber · Timestamp · TotalRows · TotalCols

NavigationLine(...) · Lines(...)

Persistencereload · duplicate · recent · session · disable

Shared with Query Tabssame row helpers and built-ins

Evaluation order.

Expression filters run after the active tab has applied its source reader, profile parser, virtual columns, quick filters, highlights, and live-source behavior. The expression then decides which rows remain visible.

scope

Runs over the active view

Quick filters and profile parsing run first. The expression only decides which of the remaining rows should stay visible.

cols

Use readable field names when you can

Write Level or Service for ordinary columns. Use Col("sc-status"), Col(2), or Has("sc-status") for awkward, optional, or positional fields.

row

The original row is still available

Use RawLine, RowNumber, Timestamp, TotalRows, and TotalCols when the parsed columns are not enough.

nav

Check nearby lines when context matters

Line(rowNumber) and Lines(start, end) let a filter look at previous or nearby rows without preprocessing the log.

helpers

Common log checks are built in

String, regex, numeric, time, and network helpers cover the usual cases: Contains, RegexIsMatch, ParseDouble, Age, IsPrivateIp, and more.

state

The filter stays with the tab

Disable it, re-enable it, reopen from recent history, duplicate the panel, or save the session without turning the filter into a throwaway shell command.

Examples.

These examples cover status checks, time windows, optional fields, previous-line guards, and proximity checks that do not fit a basic column dialog.

error or 5xxtyped compare

Level == "Error"
  || Col("sc-status").AsInt32() >= 500

Generic enough for JSONL, Apache/IIS-style status fields, or an ad-hoc parser with a typed status column.

last 15 minutestime window

Timestamp >=
  NowUtc().AddMinutes(-15)
  && Service == "api"

Works best when the active profile exposes a typed timestamp column, which is already true for the built-in structured profiles.

hyphenated or optional columnHas + Col

Has("s-port")
  && Col("s-port") == "80"
  && Contains(Message, "listen")

Useful when the source schema carries dashes, spaces, or columns that only exist on some rows.

previous line markerline navigation

RowNumber > 1
  && Line(RowNumber - 1)
       .Col("Marker") == "BEGIN"

Useful when one row opens context and the next row carries the payload you actually care about.

look behind for failurenearby rows

Lines(RowNumber - 5, RowNumber - 1)
  .Any(line => line.Col("Status") == "500")

Lines(...) gives you nearby rows; standard LINQ helpers like Any(...) are available over that sequence.

public caller onlyhelpers

!IsPrivateIp(Ip)
  && RegexIsMatch(RawLine, "POST|PUT")

Use the parsed column if you have it, then fall back to RawLine when the signal only exists in the original text.

CLI openinitial state

logace ./app.log \
  --filter-expr "Level == \"Error\""

logace ./access.log \
  --filter-expr "Col(\"sc-status\").AsInt32() >= 500"

logace ./app.log \
  --filter-expr-disable

Use --filter-expr-file when you want the predicate in versioned text instead of inline shell quoting.

When to use expression filters.

Use the normal filter dialog for simple include/exclude rules. Use expression filters when the condition needs parsed numbers, quoted field names, helper functions, or line-to-line context.

Open, check, apply, keep the draft

Ctrl+Shift+F opens the dialog.
Check compiles without applying.
History and Ctrl+Up / Ctrl+Down walk previous expressions.
Disable keeps the text but turns the predicate off.
The CLI mirrors that flow with --filter-expr-file and --filter-expr-disable.

Use column filters first when they already solve it

Per-column filters remain the fastest way to pre-shrink the candidate set. The expression then becomes the second layer for the logic that does not map cleanly to a single column editor.

Expressions are also the row language for Query Tabs

The same row surface shows up again in derived query tabs: direct identifiers, quoted columns, line navigation, and the same helper functions.

Query tabs → Back to features →