Ability to customize event listings

[tj]

Currently it's just MESSAGE KEY=VALUE, ... which is generally fine, but it might be nice to allow customers to "pin"(?) fields which would move them to the front of the log line, and remove the key name.

A normal log might look like:

timestamp INFO request method=PUT path=/settings/ app=api host=api-05

But suppose you pin app and host, you'd now have:

timestamp INFO request api api-05 request method=PUT path=/settings/

Likewise the HTTP method and path are pretty self-explanatory, pinning them would be nice:

timestamp INFO request api api-05 request PUT /settings/

A similar feature is that instead of special-casing field formats by name, allow the customer to select a format when they click a field (and of course memorize it).

Maybe hiding fields as well with some checkbox in the discovered fields panel?

I suppose the alternative to all of this would be to standardize more combinations of fields and/or messages.

Some more suggestions:

• manually set field types
• manually control field order
• manually pin fields to the start (possibly hiding their labels)
• manually hide fields from the main event view (they'd still be queryable and show up in the details pane)
• set conditional formatting on number/duration/file size fields (e.g. if value > 1s then red else green)
• enable colour per value for a field - i.e. a colour is chosen by hashing the field value
• add "scope selection" or "filter toggle" or something like that, which would be an element under/above the search bar that lets you enable/disable an additional filter that is applied before the current search. This would be useful for quickly toggling between production/staging, and for quickly setting the minimum level.