Add to HIST the ability to display the number of matches based on arbitrary patterns

[maxim-lbmv]

To analyze the relationships between errors, you need to view the sequence of their occurrence. This problem can be easily solved using graphs that display the number of messages per unit of time. If you combine several of these graphs, you can clearly see that after a certain error, another always follows. Or that after a certain number of warnings in one of the applications, an error occurs in the other.

In the lnav application, this function is already implemented in the form of HIST but for fixed templates. If you add the ability to add custom templates, log analysis will become much easier.

Custom templates can also include numeric value captures to plot, for example, RAM usage or other parameters, which would also be useful for tracking down the cause of errors.

In the pictures there is an example from your data; in real data, of course, everything is much clearer.

[tstack]

This is technically possible right now using a DB query, but it's a hassle:

;select tslice, tslice, json_group_object(cs_method, total) from (SELECT cs_method, timeslice(log_time_msecs, '5m') as tslice, count(*) as total from access_log group by tslice, cs_method) group by tslice

I added support for PRQL in the last release, which should make it possible to simplify this query quite a bit. I'll add something for that in the upcoming patch release.