Features: Log Lion

Color

The feature that makes Log Lion easier to read than Event Viewer or a text editor. It needs no setup.

Syntax highlighting: Numbers, quoted strings, name=value pairs, GUIDs, hex values and identifiers each get their own color inside every message.
Color by column: Every distinct value in a column you choose gets its own color. Color by thread, session, account or level and patterns separate into strands.
Highlight rules: Mark every match of a regular expression at once. Several rules can be active together, each in its own color, and saved as profiles.
Color a filter: Color what a filter matches instead of hiding the rest, so you keep the context around each match.
Indentation level and alternating rows: See nesting depth as bands of color, or shade every other row in wide tables.
Color in exports: Copies and exports to HTML and RTF keep the colors you see, ready to paste into a ticket or a report.

Log Lion reads Windows logs natively, live and from files.

Windows Event Logs: Browse the live Application, System and Security logs and other classic event logs, or open .evtx files collected from other machines.
Legacy event log files: Open .evt files directly, including files left unclosed by a crash or power loss.
ETW event traces: Decode .etl captures from logman, wpr, xperf and Performance Monitor into time, provider, event ID, level, process, thread and message columns. Traces are indexed on first open, so they reopen fast.
Windows Defender Firewall: Log Lion checks each firewall profile's logging settings and lists a source for every profile that has logging enabled.
Debug output: Capture OutputDebugString output live with timestamps, including from Windows services.

Structured formats open with their structure intact.

Web server logs: IIS and other W3C Extended Log Format files.
CSV, TSV and JSON Lines: With automatic detection of time columns and content-based file type detection.
logfmt, HAR and BSON: logfmt name=value logs, HTTP Archive captures from browser developer tools, and MongoDB BSON dumps with nested fields flattened into columns.
SQL databases: Read logs stored in a table in SQL Server, PostgreSQL, MySQL, Oracle, SQLite or any database with an ODBC driver. Watch the video.
Custom text logs: Teach Log Lion any text format once with the Import Text Log wizard, then open matching files directly. Watch the video.
Compressed files: Open .zip and .gz files without unpacking them first.

Narrow millions of entries down to the ones that matter.

Filter language: Word and phrase search, column comparisons, regular expressions, variables and AND/OR/NOT logic, in an editor with syntax highlighting. Watch the video.
Saved filters: Keep filters in groups, reuse them, and share them with your team.
Search: Search any column with match case, whole word, regular expression and boolean word search.
Navigation: Go to a time, step to the next matching entry, move through row history, and bookmark findings.

Answer questions about the log without exporting it first.

Timeline: See entry volume over time, so bursts and gaps are obvious at a glance.
Analysis tools: Histogram, subtotals, column statistics, a profiler for begin and end event durations, a word counter, and an unmatched-pairs finder for requests that never got a response.
Scripts: Run a Lua script over every entry to compute your own results. Watch the video.
Export: Save or copy entries as HTML, RTF, CSV or XML.

Built for large files and for evidence you can't afford to change.

Read-only: Log Lion never writes to a log file.
Multi-threaded: Parsing, indexing, filtering and searching run in the background, so you can work with the first rows while the rest load.
Live logs: Follow growing logs with auto-refresh.
Time zones: Adjust displayed times for logs recorded in UTC or another region.

The systems your services run on, read as logs. Built and signed by Regal Logic, and installed with Log Lion.

Docker: Every container in a compose project, or the ones you pick, from this computer's engine or a remote one, merged by time and followed live. Each container gets its own color, and JSON and logfmt lines open as fields. New in 3.1.3.
Connection files: Save As in the Open Docker dialog writes a .docker file that opens the same view again. Edit it to decode each service's lines with JSON, logfmt or a pattern, and to show their fields as columns.

When Log Lion doesn't know a format, you can add it.

Extension SDK: A documented C interface for adding log formats and live data sources, with sample extensions and a tool that checks an extension before it is installed.
Safe loading: Log Lion asks before loading an extension from another publisher, shows its publisher and fingerprint, and remembers the answer against the file's SHA-256. Extensions signed by Regal Logic load without asking.