tstack
Arbitrarily transform a value outside of pretty print view
I have a log where I would like to replace a "||" symbol with an empty string and also URL decode the string. I want to be able to view it this way in the normal view, not just in pretty print view. I'm assuming that you only allow rewriter in pretty print view because of performance reasons if you were tailing a log file? What if we had a property we could define in the format file that said the file would be viewed in "offline-mode"? Meaning that once it's loaded, it does not get refreshed. In this mode, the "rewriter:" logic would apply in the normal viewing mode.
Alternatively, allow the "offline-mode" property to create virtual tables that allow UPDATE operations so that we can just update the virtual table to modify columns.
Also open to any other good ideas you might have to accomplish what I want...I haven't been able to figure out anything clever other than transforming the file with a script before I feed it to lnav and I really don't want to create that type of dependency if I can avoid it.
I've pushed back on this previously because I wanted lnav to work with just the existing files on disk and not have any extra footprint. So, yes, the performance hit of transforming content on the fly would be bad, especially for searches.
However, at this point, there's multiple examples of lnav performing transformations and caching the results (e.g. unpacking archives, uncompressing files to improve SQL performance). So, it might be time to revisit these decisions. The implementation would probably transform the file using some SQLite statements and cache the resulting output. But, I probably won't get to it for awhile.
