Home / Docs / Expression filters

Expression filters.

An expression filter evaluates a C# condition for each row in the active view and keeps rows where the result is true. Use it for parsed numbers, time windows, optional fields, nearby lines, and string or regex helpers.

RETURNS bool
SCOPE active view
OPEN Ctrl+Shift+F
CLI --filter-expr · --filter-expr-file
expression filter · main shape condition 
# keep only rows that match this condition
Level == "Error"
  || Col("sc-status").AsInt32() >= 500

# the same filter can use parsed time and service fields
Timestamp >= NowUtc().AddMinutes(-15)
  && Service == "api"
Use direct identifiers for C#-safe column names. Reach for Col("name") when the schema contains spaces, dashes, or names that collide with built-ins.
Return typebool only
Column accessIdentifier · Col("name") · Col(1) · Has("name")
ContextRawLine · RowNumber · Timestamp · TotalRows · TotalCols
NavigationLine(...) · Lines(...)
Persistencereload · duplicate · recent · session · disable
Shared with Query Tabssame row helpers and built-ins
§ EX Overview what the filter sees

Evaluation order.

Expression filters run after the active tab has applied its source reader, profile parser, virtual columns, quick filters, highlights, and live-source behavior. The expression then decides which rows remain visible.

01·scope
Runs over the active view
Quick filters and profile parsing run first. The expression only decides which of the remaining rows should stay visible.
02·cols
Use readable field names when you can
Write Level or Service for ordinary columns. Use Col("sc-status"), Col(2), or Has("sc-status") for awkward, optional, or positional fields.
03·row
The original row is still available
Use RawLine, RowNumber, Timestamp, TotalRows, and TotalCols when the parsed columns are not enough.
04·nav
Check nearby lines when context matters
Line(rowNumber) and Lines(start, end) let a filter look at previous or nearby rows without preprocessing the log.
05·helpers
Common log checks are built in
String, regex, numeric, time, and network helpers cover the usual cases: Contains, RegexIsMatch, ParseDouble, Age, IsPrivateIp, and more.
06·state
The filter stays with the tab
Disable it, re-enable it, reopen from recent history, duplicate the panel, or save the session without turning the filter into a throwaway shell command.
§ EX·2 Examples common examples

Examples.

These examples cover status checks, time windows, optional fields, previous-line guards, and proximity checks that do not fit a basic column dialog.

error or 5xxtyped compare
Level == "Error"
  || Col("sc-status").AsInt32() >= 500
Generic enough for JSONL, Apache/IIS-style status fields, or an ad-hoc parser with a typed status column.
last 15 minutestime window
Timestamp >=
  NowUtc().AddMinutes(-15)
  && Service == "api"
Works best when the active profile exposes a typed timestamp column, which is already true for the built-in structured profiles.
hyphenated or optional columnHas + Col
Has("s-port")
  && Col("s-port") == "80"
  && Contains(Message, "listen")
Useful when the source schema carries dashes, spaces, or columns that only exist on some rows.
previous line markerline navigation
RowNumber > 1
  && Line(RowNumber - 1)
       .Col("Marker") == "BEGIN"
Useful when one row opens context and the next row carries the payload you actually care about.
look behind for failurenearby rows
Lines(RowNumber - 5, RowNumber - 1)
  .Any(line => line.Col("Status") == "500")
Lines(...) gives you nearby rows; standard LINQ helpers like Any(...) are available over that sequence.
public caller onlyhelpers
!IsPrivateIp(Ip)
  && RegexIsMatch(RawLine, "POST|PUT")
Use the parsed column if you have it, then fall back to RawLine when the signal only exists in the original text.
CLI openinitial state
logace ./app.log \
  --filter-expr "Level == \"Error\""

logace ./access.log \
  --filter-expr "Col(\"sc-status\").AsInt32() >= 500"

logace ./app.log \
  --filter-expr-disable
Use --filter-expr-file when you want the predicate in versioned text instead of inline shell quoting.
§ EX·3 Workflow where it fits

When to use expression filters.

Use the normal filter dialog for simple include/exclude rules. Use expression filters when the condition needs parsed numbers, quoted field names, helper functions, or line-to-line context.

Open, check, apply, keep the draft

  • Ctrl+Shift+F opens the dialog.
  • Check compiles without applying.
  • History and Ctrl+Up / Ctrl+Down walk previous expressions.
  • Disable keeps the text but turns the predicate off.
  • The CLI mirrors that flow with --filter-expr-file and --filter-expr-disable.

Use column filters first when they already solve it

Per-column filters remain the fastest way to pre-shrink the candidate set. The expression then becomes the second layer for the logic that does not map cleanly to a single column editor.

Expressions are also the row language for Query Tabs

The same row surface shows up again in derived query tabs: direct identifiers, quoted columns, line navigation, and the same helper functions.

QUERY TABS → BACK TO FEATURES →