Query tabs.

A query tab derives a new result tab from the active log view. Use Rows() and LINQ-style methods to filter, project, group, summarize, order, and keep the output inside LogAce.

OPEN Ctrl+Q

EDIT Ctrl+Shift+Q

MODES snapshot · live

RESULT normal tab

query tab · grouped result LINQ-style

Rows()
  .GroupBy(r => r.Col("Status"))
  .Select(g => new
  {
      Status = g.Key,
      Count = g.Count()
  })
  .OrderByDescending(x => x.Count)

The result opens as a normal tab, so search, export, detail view, duplicate, and sessions keep working on the derived output.

Sourceactive log view

Modessnapshot or live

Root APIRows()

GroupingGroupBy(...) · Summarize(...)

AggregatesCountIf · DistinctCount · Avg · Percentile

Persistencesaved definitions + query history + sessions

§ QY Overview derived tabs, not exports

Query result behavior.

A query result opens as a normal tab. You can search it, export it, duplicate it, save it in a session, or edit the query definition later.

01·source

Start from the log view you already narrowed

The source tab has already applied its parser, columns, quick filters, expression filter, and live source behavior. The query builds on that view.

02·shape

Return another table

Create grouped counts, one-row summaries, selected fields, latency tables, or any other result that still makes sense as rows and columns.

03·ops

Use a small set of predictable operations

Where, Select, GroupBy, Summarize, OrderBy, ThenBy, and Take cover the common shapes without turning the tab into a free-form script runner.

04·agg

Built-in summaries cover the usual questions

Count rows, count matches, find distinct values, sum, average, min, max, and percentiles without leaving the grid.

05·live

Keep it live when the source keeps growing

If LogAce can update the result as new rows arrive, the tab stays live. If the query needs a snapshot, the dialog tells you before opening it.

06·state

Keep and edit the definition

Query tabs remember their definition and history. Ctrl+Shift+Q edits the current tab in place, and sessions reopen it later.

§ QY·2 Examples common examples

Start narrow, then summarize.

The first useful queries are usually small: narrow to matching lines, count by status, summarize errors, or extract the few fields you need for the next step.

raw line grepsnapshot or live

Rows()
  .Where(r =>
      Contains(r.RawLine, "error"))

The smallest useful query. Keep it live when you want a continuously updating "only lines that match this string" tab.

status histogramgrouped

Rows()
  .GroupBy(r => r.Col("Status"))
  .Select(g => new
  {
      Status = g.Key,
      Count = g.Count()
  })
  .OrderByDescending(x => x.Count)

Use this when you need the main buckets in the current view.

one-row summarysummarize

Rows()
  .Summarize(g => new
  {
      Total = g.Count(),
      Errors = g.CountIf(
          r => r.Col("Level") == "Error")
  })

Use this when you want a compact one-row summary without leaving the grid UI.

marker-aware projectionnearby rows

Rows()
  .Where(r =>
      r.TotalCols == 3
      &&
      r.RowNumber > 1
      && r.Line(r.RowNumber - 1)
             .Col("Marker") == "BEGIN")
  .Select(r => new
  {
      Port = r.Col("s-port"),
      SecondColumn = r.Col(2),
      r.RawLine
  })

Use this when one row starts the context and another row carries the fields you want in the summary.

latency percentileaggregate

Rows()
  .GroupBy(r => r.Service)
  .Select(g => new
  {
      Service = g.Key,
      P95Ms = g.Percentile(
          r => r.Col("DurationMs"), 95),
      MaxMs = g.Max(
          r => r.Col("DurationMs").AsDouble())
  })
  .OrderByDescending(x => x.P95Ms)

Use this when the source tab already exposes a parsed duration column.

CLI openderived tab

logace --query-source ./app.log \
  --query-text "Rows().Where(r => r.Level == \"Error\")"

logace --query-source ./app.log \
  --query-file ./queries/errors-by-service.txt \
  --query-mode live

Use inline text for quick one-offs, then move the query into a file when it deserves version control or shell reuse.

§ QY·3 Live Mode live when the source grows

Run once, or keep the result updating.

The same query can be a one-shot snapshot or a live result tab. When new rows can be folded into the result cleanly, LogAce keeps it updating. When they cannot, it opens as a snapshot instead of pretending.

Good live results

Where and Select pipelines.
GroupBy or Summarize with built-in aggregates.
OrderBy and Take over the derived result.
Derived tabs fed by append-only follow sources like remote, Docker, kubectl, or syslog tabs.

When a snapshot is fine

Some useful questions need the whole current view at once: profile changes, schema changes, expression edits, or query shapes that cannot be updated row by row. Those still work; they just run as snapshots.

The same field access as expressions

Queries use the same helpers as Expression Filters: direct field names, Col("name"), Col(1), Has(...), RawLine, RowNumber, Timestamp, TotalRows, TotalCols, Line(...), and Lines(...).

EXPRESSION FILTERS → BACK TO FEATURES →