v0.26.3 web viewer improvement

doc/architecture.md

@@ -83,7 +83,8 @@ registry rejects a second instance of any such type.
 - `Node`: origin node label for chained topologies; stamped at the first hop,
   preserved by relays.
 - `Source`: origin identifier within the node (filename, plugin id, …).
-- `Level`: `DEBUG`, `INFO`, `WARN`, `ERROR` or `TRACE`, when detected.
+- `Level`: `TRACE`, `DEBUG`, `INFO`, `WARN` or `ERROR`, when detected; the
+  words naming each are one table, `core.Levels`.
 - `Message`: log content.
 - `Fields`: optional structured metadata as raw JSON.
 - `RawSize`: original byte size, used by the entry-size cap.

doc/sinks.md

@@ -54,10 +54,10 @@ Payloads are written as the formatter made them, one record per line.
   characters, such as the joiners emoji and Indic scripts need, are kept.
   `never` keeps an application's own ANSI colours; under `auto`, pipes and
   files get the bytes unchanged.
-- Color: the first whole word in a line, in any case, that names the entry's
-  level is painted: `DEBUG`/`DBG` cyan (blue is hard to read on black),
-  `INFO`/`INF` green, `WARNING`/`WARN` yellow, `ERROR`/`ERR`/`FATAL` bold red,
-  `TRACE` grey. The colors are ANSI 16, so the terminal's theme picks the
+- Color: the first word in a line naming the entry's level, by the names the
+  [sources](sources.md#file) read, is painted: `DEBUG` cyan (blue is hard to
+  read on black), `INFO` green, `WARN` yellow, `ERROR` bold red, `TRACE`
+  grey. The colors are ANSI 16, so the terminal's theme picks the
   shades and a Linux or BSD text console renders them; the codes are the
   sink's own, written after escaping. A line whose source found no level
   stays plain. The codes go into whatever the format makes, JSON included:
@@ -216,7 +216,9 @@ Options, each as type and default:
     to: `/` is refused like any other path;
   - an endpoint at `/` keeps the root, and the viewer stays at `/auth/view`.
   The viewer starts with the `replay_lines` backlog, holds one stream against
-  `max_connections`, and says so when all are taken (`server full`).
+  `max_connections`, and says so when all are taken (`server full`). Its
+  search keeps the lines containing a text, in any case, and its level list
+  the entries at or above a level, read as the sources read it.
 - Refusals are logged at WARN and counted in `auth_rejected`. The authorized
   identity is recorded in the client's session as `auth_method` /
   `auth_identity`.

doc/sources.md

@@ -68,8 +68,11 @@ Options, each as type and default:
 - A line is parsed as JSON only when it is an object whose top-level keys are
   all drawn from `time`, `level`, `msg` and `fields` — the four an entry can
   carry. `time` is read as RFC3339Nano. Any other key, and any non-object line,
-  is kept whole as text with the level inferred from common markers
-  (`[ERROR]`, `WARN:`, and so on), because parsing it would drop the rest.
+  is kept whole as text, because parsing it would drop the rest.
+- A text line's level is its first whole word, in any case, naming one:
+  `TRACE`; `DEBUG`, `DBG`; `INFO`, `INF`; `WARN`, `WARNING`; `ERROR`, `ERR`,
+  `FATAL`. `warning: disk full` is WARN, `INFO retry after error` INFO. The
+  console sink paints that word and the http sink's viewer filters on it.
 - `raw = true` skips the JSON branch entirely. The line, plus its newline,
   becomes the message; `fields` stays empty, the time is the read time, and the
   level is inferred from the text as for any unparsed line. Paired with

doc/todo.md

@@ -65,11 +65,7 @@ identity, and both skeletons download the tagged source.
 
 Smaller items found along the way, each independent of the others.
 
-1. Level detection. `source.ExtractLogLevel` needs a delimiter after the name
-   (`ERROR:`, `[WARN]`, ` INFO `), so `warning disk full` or `DBG x` get no
-   level, hence no color. Match the names as words, as the console sink's
-   painter does, with one table for both.
-2. Command line:
+1. Command line:
    - a positional word at the top level (`lw tail`, `lw -t FILE`) still reaches
      config with an unclear message; name it ("unexpected argument X; the file
      is -c FILE");
@@ -79,9 +75,9 @@ Smaller items found along the way, each independent of the others.
    - `lw tls cert --host` could become `--hosts` (keeping `--host`), to match
      `tls.hosts` and the preset key;
    - top-level usage errors exit 1, subcommand ones 2.
-3. TLS: the generated-certificate key is one per process, so a pin taken from a
+2. TLS: the generated-certificate key is one per process, so a pin taken from a
    `self_signed` listener also matches an `issuer` listener of the same
    process; document it or key per listener. Pins are checked in
    `VerifyPeerCertificate`, which Go skips on resumption: guard it if a dialer
    ever keeps a `ClientSessionCache`.
-4. `core.ShutdownTimeout` is unused.
+3. `core.ShutdownTimeout` is unused.